Two-factor authentication bypass

Zohocorp ManageEngine Key Manager Plus2026-11-03 04:57 UTC1 min readRead in

Summary

ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.

Remediation

Inventory every Zohocorp ManageEngine Key Manager Plus deployment, including staging.
Upgrade Zohocorp ManageEngine Key Manager Plus to 7151.
Confirm the running version after the upgrade.

References

Referencehttps://www.manageengine.com/key-manager/advisory/cve-2026-77799.html

CVSS vector

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected versions

Version	Fixed in
0 – <7151	7151

Weakness

CWE-288

Timeline

2026-11-03Publicly disclosed

Sources

CVE · NVD