Improper access control vulnerability

Zohocorp ManageEngine Key Manager Plus2026-11-03 10:17 UTC1 min readRead in

Summary

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.

Remediation

Inventory every Zohocorp ManageEngine Key Manager Plus deployment, including staging.
Upgrade Zohocorp ManageEngine Key Manager Plus to 7151.
Confirm the running version after the upgrade.

References

Referencehttps://www.manageengine.com/key-manager/advisory/cve-2026-77777.html

CVSS vector

Attack vector: Network
Complexity: High
Privileges: Low
User interaction: None
Scope: Changed
Confidentiality: High
Integrity: Low
Availability: None

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Affected versions

Version	Fixed in
0 – <7151	7151

Weakness

CWE-1220

Timeline

2026-11-03Publicly disclosed

Sources

NVD · CVE