CVE-2026-86708 is a vulnerability in Zoho Corp Manageengine Applications Manager
Published on September 23, 2026
Sensitive data exposure
ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.
Vulnerability Analysis
CVE-2026-86708 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality and integrity, and no impact on availability.
Weakness Type
Use of Hard-coded Cryptographic Key
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Products Associated with CVE-2026-86708
Want to know whenever a new CVE is published for Zoho Corp Manageengine Applications Manager? stack.watch will email you.
Affected Versions
Zohocorp ManageEngine Applications Manager:- Before 182300 is affected.