Authentication bypass vulnerability

Zohocorp ManageEngine Key Manager Plus2026-11-03 05:18 UTC1 min readRead in

Summary

ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.

Remediation

Inventory every Zohocorp ManageEngine Key Manager Plus deployment, including staging.
Upgrade Zohocorp ManageEngine Key Manager Plus to 7151.
Confirm the running version after the upgrade.

References

Referencehttps://www.manageengine.com/key-manager/advisory/cve-2026-77800.html

CVSS vector

Attack vector: Network
Complexity: High
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: Low

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L

Affected versions

Version	Fixed in
0 – <7151	7151

Weakness

CWE-304

Timeline

2026-11-03Publicly disclosed

Sources

NVD · CVE