---
id: "CVE-2026-77777"
kind: "vulnerability"
aliases: ["CVE-2026-77777"]
title: "ManageEngine Key Manager Plus: access control flaw lets users change others' ACME credentials"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["certificates", "infrastructure", "key-manager-plus", "manageengine"]
not_affected_if: ["single-user-deployment", "version-7151-or-later"]
published_at: "2026-11-03T10:17:19+00:00"
first_seen_at: "2026-11-03T10:20:16+00:00"
updated_at: "2026-11-03T10:20:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77777", "first_seen_at": "2026-11-03T10:20:16+00:00"}]
---

# ManageEngine Key Manager Plus: access control flaw lets users change others' ACME credentials

Key Manager Plus versions before 7151 have an improper access control flaw. An authenticated user can modify another user's ACME certificate deployment credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Key Manager Plus version in the admin console; the sources say versions before `7151` are affected.
- Review which accounts can access ACME certificate deployment settings.

## Fix

- Move to Key Manager Plus `7151` or later (per the sources; confirm against the vendor advisory).

## Timeline

- 2026-11-03T10:20:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77777

## From the sources

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_