Key Manager Plus CVE-2026-77777

Requires an authenticated Key Manager Plus account (PR:L) on an instance running a version before build 7151; the attacker then modifies another user's ACME certificate deployment credentials via the improper access-control flaw. Limiting factors: valid application credentials are mandatory (no unauthenticated path), the CVSS vector rates attack complexity high (AC:H), and exploitation is bounded to the ACME certificate deployment credential functionality. The specific precondition or configuration that triggers the access-control failure is not described in the available sources. The only complete fix stated by the vendor is upgrading to build 7151.

Signals are moderate and partly internally inconsistent. The CVSS 3.1 base score of 7.1 is driven largely by S:C (scope change) and C:H, yet the description describes an authenticated user modifying another user's ACME certificate deployment credentials - an access-control/integrity problem, not a disclosure one - so the C:H confidentiality weighting is hard to reconcile with the stated behavior and should be verified with Zoho. The attack vector is network (AV:N) but requires authentication (PR:L) and is rated high complexity (AC:H), both of which meaningfully reduce real-world exploitability; the attacker must already hold a valid Key Manager Plus account. The vuln.today priority is 'this_week' (not act_now/emergency), and no EPSS score, CISA KEV listing, or public PoC/exploit reference is present in the input, so there is no evidence of active exploitation or mass-exploitation pressure. Net: a legitimate multi-user authorization weakness worth patching on a normal cycle, not a drop-everything emergency, with the caveat that the C:H rating and the modification-only description conflict and warrant vendor confirmation.

A low-privileged but authenticated user of ManageEngine Key Manager Plus (before build 7151) abuses the improper access-control check to reach and modify ACME certificate deployment credentials belonging to another user. By altering those deployment credentials, the attacker could disrupt or redirect certificate deployment for the victim's resources. No public exploit identified at time of analysis, and the exact trigger is not described in the available sources.