CVE-2026-77690 · Vendor
NO FIX YET · SEE WHAT TO DO
ManageEngine Key Manager Plus before build 7151 has a command injection flaw in its certificate deployment target configuration. An authenticated user with certificate deployment privileges can run arbitrary commands on the server through crafted input.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Only installations of Key Manager Plus before build 7151 are exposed, and only through accounts with certificate deployment privileges when configuring a deployment target. Teams that run no Key Manager Plus, or whose builds are at 7151 or later, can skip it. Sources do not say whether the flaw is reachable from outside the network.
Not affected if build-7151-or-later, no-certificate-deployment-privileges
Who cares certificate-management, key-manager-plus, manageengine, windows
71517151 or laterZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.
This page as .md · .json · in your agent: get_signal("CVE-2026-77690") · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.