Live › vulnerability › CVE-2026-77800
ManageEngine Key Manager Plus before build 7151 accepts SAML assertions that were issued for a different service provider. An attacker holding such an assertion can log in to Key Manager Plus without valid credentials for it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 05:48 UTC. All times on this page are UTC.
Organizations running ManageEngine Key Manager Plus builds before 7151 that use SAML single sign-on are exposed. Installations without SAML login configured are unlikely to be affected, though the sources do not say that explicitly.
No product ranges from the sources yet.
71517151 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.
This page as .md · .json · in your agent: get_signal("CVE-2026-77800")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.