Live › vulnerability › CVE-2026-77778
Key Manager Plus up to version 7150 lets any authenticated user export certificates that belong to other users into their own registered key vaults. An attacker with a normal account can take certificates and keys they should not be able to see.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 10:20 UTC. All times on this page are UTC.
Organizations that run ManageEngine Key Manager Plus at or below version 7150 and let more than one user register key vaults. Exposure depends on users with valid accounts on the server; instances without multiple authenticated users are less exposed. unknown for anything beyond that.
No product ranges from the sources yet.
7150; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
This page as .md · .json · in your agent: get_signal("CVE-2026-77778")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.