CVE-2026-77779

Published: Nov 4, 2026Modified: Nov 4, 2026

7.7

Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L

Exploitability: 1.8 / Impact: 5.3

Source: 0fc0942c-577d-436f-ae8e-945763c79b02 (Secondary)

Description

ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.

Related CWEs

CWE-1220

Insufficient Granularity of Access Control

The product implements access controls via a policy or other feature with the intention to disable or restrict accesses (reads and/or writes) to assets in a system from untrusted agents. However, implemented access controls lack required granularity, which renders the control policy too broad because it allows accesses from unauthorized agents to the security-sensitive assets.

References (1)

https://www.manageengine.com/key-manager/advisory/cve-2026-77779.html

Source: 0fc0942c-577d-436f-ae8e-945763c79b02

Timeline

No history available yet.