ManageEngine Key Manager Plus Improper Access Control in Export Key Feature
CVE-2026-77779 Published on November 4, 2026
Improper access control vulnerability
ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.
Vulnerability Analysis
CVE-2026-77779 can be exploited with network access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
Insufficient Granularity of Access Control
The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.
Products Associated with CVE-2026-77779
Want to know whenever a new CVE is published for Zoho Corp Manageengine Key Manager Plus? stack.watch will email you.
Affected Versions
Zohocorp ManageEngine Key Manager Plus:- Before 7151 is affected.