Key Manager Plus CVE-2026-77691

Requires an authenticated session on ManageEngine Key Manager Plus (any version before 7151) and access to the feature that configures a Microsoft Certificate Authority integration; the attacker supplies malicious input into that CA-configuration workflow. Limiting factors: valid credentials are required (PR:L - this is not remote-unauthenticated), the attacker must be able to reach the Microsoft CA configuration function, and the deployment must be on a vulnerable build (<7151). No user interaction by a victim is needed (UI:N). The exact input field and how it is passed to the OS command are not described in the available sources.

This is a genuine but conditional priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) describes a network-reachable, low-complexity flaw, but PR:L confirms it requires an authenticated session - so the realistic threat is a malicious or compromised low-privileged user, not an anonymous internet attacker. The vuln.today decision label is 'this_week' (not act_now/emergency), which aligns with that reading. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference were provided, so there is currently no public exploit identified and no evidence of active or automatable exploitation. The main risk driver is impact: CWE-78 (OS command injection) typically yields command execution on the host, which is why the vendor rates C:H/I:H. One signal to flag: the supplied vector sets A:H to N (A:N), yet command injection usually also affects availability - see assessed vector below. Net: treat as a high-severity, authentication-gated issue warranting prompt patching of internet-facing or multi-tenant Key Manager Plus consoles, but not a widespread remote-unauth crisis.

An authenticated Key Manager Plus user with access to certificate-authority configuration navigates to the Microsoft CA setup and submits input containing shell metacharacters. Because that input is passed to an OS command (CWE-78), the crafted payload executes arbitrary commands on the underlying server with the service's privileges. No public exploit was identified at time of analysis.