CVE-2026-77778 - Vulnerability Details

Description

ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.

Published: 2026-11-03

Score: 7.1 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow an authenticated user to export certificates that belong to other users and place them into their own registered key vaults, exposing those certificates to unauthorized parties.

Affected Systems

Zohocorp ManageEngine Key Manager Plus, version 7150 and earlier.

Risk and Exploitability

The vulnerability has a CVSS score of 7.1; its EPSS score is not available and it is not listed in the CISA KEV catalog. The attack vector requires only authenticated access, so a compromised or legitimate user account can exploit the flaw to obtain other users’ certificates, potentially leading to privacy breaches and misuse of the exported certificates.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Zohocorp

ManageEngine Key Manager Plus

unaffected

Version	Status	Constraints
`0`	affected	< 7151

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade to a version newer than 7150 or apply the vendor patch that addresses CVE-2026-77778.
Limit export rights so that only administrators or trusted roles can export certificates.
Enable logging and regularly review export activity to detect suspicious certificate extraction.

Generated by OpenCVE AI on November 3, 2026 at 10:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://www.manageengine.com/key-manager/advisory/cve-2026-77778.html

History

Tue, 03 Nov 2026 09:45:00 +0000

Type	Values Removed	Values Added
Description		ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
Title		Improper access control vulnerability
First Time appeared		Zohocorp Zohocorp manageengine Key Manager Plus
Weaknesses		CWE-1220
CPEs		cpe:2.3:a:zohocorp:manageengine_key_manager_plus::::::::
Vendors & Products		Zohocorp Zohocorp manageengine Key Manager Plus
References		https://www.manageengine.com/key-manager/advisory/cve-2026-77778.html
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N'}`

Subscriptions

Zohocorp Manageengine Key Manager Plus

MITRE

Status: PUBLISHED

Assigner: Zohocorp

Published: 2026-11-03T09:42:23.306Z

Updated: 2026-11-03T09:42:23.306Z

Reserved: 2026-08-21T11:11:16.968Z

Link: CVE-2026-77778

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-11-03T10:17:19.773

Modified: 2026-11-03T10:17:19.773

Link: CVE-2026-77778

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-11-03T10:30:13Z

Weaknesses

CWE-1220
Insufficient Granularity of Access Control

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-77778", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "Zohocorp", "dateReserved": "2026-08-21T11:11:16.968Z", "datePublished": "2026-11-03T09:42:23.306Z", "dateUpdated": "2026-11-03T09:42:23.306Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-11-03T09:42:23.306Z"}, "title": "Improper access control vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1220", "description": "CWE-1220 Insufficient granularity of access control", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-114", "descriptions": [{"lang": "en", "value": "CAPEC-114 Authentication Abuse"}]}], "affected": [{"vendor": "Zohocorp", "product": "ManageEngine Key Manager Plus", "versions": [{"status": "affected", "version": "0", "lessThan": "7151", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:manageengine_key_manager_plus:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "7151"}]}]}], "descriptions": [{"lang": "en", "value": "ZohoCorp\u00a0ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults."}]}], "references": [{"url": "https://www.manageengine.com/key-manager/advisory/cve-2026-77778.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N"}}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Changed

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object