CVE-2026-77779 · Other
NO FIX YET · SEE WHAT TO DO
Key Manager Plus versions before 7151 have an access control flaw that lets a logged-in low-privilege user export cryptographic keys beyond what they are authorized to see. An attacker who holds a basic account can take keys they should not have, which can expose systems those keys protect.
first public Nov 4, 2026 · 1 source
Is this in your stack? Find out in 2 minutes.
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Organisations running self-hosted ManageEngine Key Manager Plus before build 7151 that have authenticated users with low privileges. Exposure depends on whether such accounts exist and can reach the export function; installs at 7151 or later are not affected by this flaw.
Not affected if no-low-privilege-accounts, version-7151-or-later
Who cares key-manager-plus, manageengine, self-hosted
71517151 or laterManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.
This page as .md · .json · in your agent: get_signal("CVE-2026-77779") · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.