{"id":"CVE-2026-77799","kind":"vulnerability","aliases":["CVE-2026-77799"],"related":[],"title":"ManageEngine Key Manager Plus: two-factor check can be skipped with valid password","description":"ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.","summary":"ManageEngine Key Manager Plus before build 7150 lets a user with valid credentials log in without the second-factor verification code. An attacker who has a stolen or guessed password can get into the console without the extra check.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","key-manager-plus","manageengine","self-hosted","windows"],"not_affected_if":["build-7150-or-later","no-two-factor-configured"],"how_to_check":"- Look up the installed build of Key Manager Plus in the product's about page or install directory and compare it with `7150`","fix":"- Key Manager Plus: move to build `7150` or later","status":"open","published_at":"2026-11-03T05:18:52+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","triaged_at":"2026-11-03T05:49:50+00:00","updated_at":"2026-11-03T05:49:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-03T05:49:50Z","model":"claude-haiku-5-5","output":{"fix":"- Key Manager Plus: move to build `7150` or later","reach":"network","title":"ManageEngine Key Manager Plus: two-factor check can be skipped with valid password","impact":"high","summary":"ManageEngine Key Manager Plus before build 7150 lets a user with valid credentials log in without the second-factor verification code. An attacker who has a stolen or guessed password can get into the console without the extra check.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["key-manager-plus","manageengine","self-hosted","windows"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker logs in with stolen password, bypassing second factor","analyst_note":"","how_to_check":"- Look up the installed build of Key Manager Plus in the product's about page or install directory and compare it with `7150`\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["build-7150-or-later","no-two-factor-configured"],"who_is_affected":"Teams running ManageEngine Key Manager Plus, the SSH and SSL key management console, on builds before 7150 where two-factor login is enforced for accounts. Exposure depends on whether the console is reachable from untrusted networks and whether attackers could obtain user passwords. Installations already on 7150 or later are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000666,"input_tokens":4096,"output_tokens":512,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-77799':17A,20A '7150':37B,77C 'allow':88C 'attack':54B,89C 'authent':85C 'build':36B 'bypass':86C 'check':8A,70B 'code':52B,99C 'consol':66B 'credenti':43B,92C 'cve':15A,18A 'extra':69B 'factor':7A,50B,84C 'get':63B 'guess':60B 'host':29B 'infrastructur':21B 'key':2A,23B,32B,72C 'key-manager-plus':22B 'let':38B 'log':44B,94C 'manag':3A,24B,33B,73C 'manageengin':1A,26B,31B,71C 'password':14A,61B 'plus':4A,25B,34B,74C 'second':49B 'second-factor':48B 'self':28B 'self-host':27B 'skip':11A 'stolen':58B 'two':6A,83C 'two-factor':5A,82C 'user':40B 'valid':13A,42B,91C 'verif':51B,98C 'version':75C 'vulner':79C 'window':30B 'without':46B,67B,96C","nicknames":[],"mitigations":[],"who_affected":"Teams running ManageEngine Key Manager Plus, the SSH and SSL key management console, on builds before 7150 where two-factor login is enforced for accounts. Exposure depends on whether the console is reachable from untrusted networks and whether attackers could obtain user passwords. Installations already on 7150 or later are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","infrastructure","keymanagerplus","manageengine","selfhosted","windows"],"first_public_at":"2026-11-03T05:18:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-77799","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77799","severity":null,"published_at":"2026-11-03T05:18:52+00:00","modified_at":"2026-11-03T05:18:52+00:00","first_seen_at":"2026-11-03T05:48:53+00:00","fetched_at":"2026-11-03T05:48:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}