CVE-2026-77777

Published: Nov 3, 2026Modified: Nov 3, 2026

7.1

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Exploitability: 1.8 / Impact: 4.7

Source: 0fc0942c-577d-436f-ae8e-945763c79b02 (Secondary)

Description

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.

Related CWEs

CWE-1220

Insufficient Granularity of Access Control

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References (1)

https://www.manageengine.com/key-manager/advisory/cve-2026-77777.html

Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Timeline

No history available yet.