---
id: "CVE-2026-77778"
kind: "vulnerability"
aliases: ["CVE-2026-77778"]
title: "ManageEngine Key Manager Plus: logged-in users can export other users' certificates"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["key-manager-plus", "manageengine", "self-hosted", "vendor"]
not_affected_if: ["no-untrusted-accounts", "single-user-instance"]
published_at: "2026-11-03T10:17:19+00:00"
first_seen_at: "2026-11-03T10:20:16+00:00"
updated_at: "2026-11-03T10:20:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-77778", "first_seen_at": "2026-11-03T10:20:16+00:00"}]
---

# ManageEngine Key Manager Plus: logged-in users can export other users' certificates

Key Manager Plus up to version 7150 lets any authenticated user export certificates that belong to other users into their own registered key vaults. An attacker with a normal account can take certificates and keys they should not be able to see.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Key Manager Plus build against the version range in the advisory; the sources do not give a command for this.

## Fix

- Move Key Manager Plus past `7150`; the sources do not name the fixed version.

## Timeline

- 2026-11-03T10:20:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-77778

## From the sources

ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_