EUVD-2026-115732
GHSA-jhqj-68fm-5856
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privileged Key Manager Plus user
-
ExploitInvoke certificate export for another user's certificate
-
ExecutionRedirect export to attacker's own registered key vault
-
ImpactObtain other users' certificate material
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V8 - Authorization Insufficient granularity of access control
|
| Exploitation Conditions | Requires a valid authenticated account on a ManageEngine Key Manager Plus instance at version 7150 or earlier, operating in a multi-user deployment where other users own certificates and the attacker has a registered key vault to receive them. The attacker only needs low privileges (PR:L), but genuine authentication to the application is mandatory, which limits exploitation to insiders or anyone who has already obtained working credentials; the specific feature-level trigger for the export abuse is not described in the available sources. The vendor advisory is the authoritative source for the exact fixed build. |
| Impact | This is a moderate-severity authorization flaw (CWE-1220, insufficient access-control granularity) in ManageEngine Key Manager Plus. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N = 7.1) indicates a network-reachable attack by a low-privileged authenticated user (PR:L) with a scope change (S:C), meaning one user can reach certificates belonging to other users. There is no EPSS score, no CISA KEV listing, and no public exploit reference in the supplied data - the only reference is the Zoho vendor advisory. Exploitation status is therefore 'no public exploit identified at time of analysis.' The vendor-assigned AC:H raises the complexity metric, but the available sources do not describe why the attack is high-complexity, so the trigger is not described in the available sources and the AC:H justification is unverified. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a credentialed, non-automatable data-exposure issue rather than mass exploitation. Net: a real priority for multi-user Key Manager Plus deployments because cross-user disclosure of certificate material undermines the product's core trust boundary, but absent KEV/EPSS/POC signals this is not an active-exploitation emergency. |
| Exploit ScenarioDerived | A legitimate low-privileged user of ManageEngine Key Manager Plus abuses the export function to copy certificates owned by other users into their own registered key vault, obtaining material they are not authorized to hold. No public proof-of-concept is referenced in the available data, and exploitation requires a valid authenticated account on the instance. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 03, 2026
ManageEngine Key Manager Plus builds up to and including 7150 allow any authenticated low-privileged user to export X.509 certificates owned by other users into a key vault they have registered themselves, defeating the per-user isolation the product relies on in multi-user deployments. The weakness is an access-control granularity flaw (CWE-1220): the application checks that the requester is a valid user but does not enforce object-level ownership before performing the export, so confidentiality impact is high and the CVSS scope is changed because the exposed certificate material belongs to other principals rather than to the vulnerable component itself. Exploitation requires working credentials and a registered key vault to receive the stolen material, no public exploit was identified at time of analysis, and the priority label is 'this week' rather than an emergency response.
RemediationAI
Apply the vendor fix referenced in the ManageEngine advisory at https://www.manageengine.com/key-manager/advisory/cve-2026-77778.html; the exact patched build number is not listed in the data available here, so the advisory is the authoritative source for the target version and should be checked before upgrading from 7150 or earlier. Where an immediate upgrade is not possible, reduce exposure by removing the prerequisites the attack depends on rather than relying on generic hardening: restrict registration of key vault destinations to a small set of trusted administrative roles (side effect: legitimate users who self-service their own vault exports lose that capability), and where practical cut the deployment back to a single trusted owner per certificate set so no cross-user export path exists (side effect: multi-tenant administration must be consolidated). In parallel, review existing vault registrations and export activity for certificates that were pushed to vaults not owned by the certificate's owner, since any such record indicates the flaw was exercised and the affected certificates and private keys should be treated as compromised and rotated.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Key Manager Plus is an enterprise PKI and key-lifecycle management appliance: it stores certificate private keys and certificate chains, tracks ownership of those objects per user, and can push or export certificate material into external 'key vault' destinations that users register with the product. CWE-1220 (Insufficient Granularity of Access Control) describes the root cause class precisely: authorization is decided at a coarse level - 'is this a legitimate Key Manager Plus user?' - instead of at the granularity of the individual certificate object and the destination vault, so a user who owns no part of a given certificate can still select it for export. The changed-scope metric (S:C) reflects that the impact lands on resources outside the vulnerable authorization component's own security scope, namely other users' private key/certificate material and an external vault endpoint. The vendor vector records AC:H while our independent assessment scores AC:L, since a valid session and a registered vault are prerequisites the attacker can prepare in advance; the specific application feature path that triggers the abusive export is not described in the available sources. Affected builds are identified by the CPE cpe:2.3:a:zohocorp:manageengine_key_manager_plus, wildcarded across all versions at or below build 7150.
Know when Manageengine Key Manager Plus gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Network-reachable, authenticated low-privileged user (PR:L) crosses a user trust boundary (S:C) to disclose other users' certificate material (C:H) and write copies to their own vault (I:L); no description supports AC:H.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
2DescriptionCVE.org
ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
Executive ViewAI
ManageEngine Key Manager Plus versions up to 7150 contain an access-control flaw that permits any authenticated user with low privileges to export and exfiltrate X.509 certificates belonging to other users, undermining the per-user isolation fundamental to multi-tenant certificate management. Although exploitation requires valid credentials and a registered vault, the confidentiality breach could expose sensitive certificate material affecting numerous principals and potentially enabling impersonation or trust abuse. Leadership should prioritize remediation because this erodes the integrity of the key management platform and may trigger compliance and operational risks.
No vendor-released patch identified at time of analysis; interim mitigations include restricting vault registration and certificate export to trusted administrators, enforcing strict least-privilege access, and monitoring for suspicious export activity.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Zoho ManageEngine Key Manager Plus before 6001 allows Stored XSS on the user-management page while importing malicious u
Authenticated command injection in ZohoCorp ManageEngine Key Manager Plus builds before 7151 allows a logged-in user to
SAML authentication bypass in ManageEngine Key Manager Plus before 7151 allows remote attackers to log in with a SAML as
Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDR
Two-factor authentication bypass in ManageEngine Key Manager Plus builds before 7150 lets an attacker who already posses
Improper access control in ManageEngine Key Manager Plus builds prior to 7151 lets an authenticated user modify another
An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. Rated medium severity (CVSS 6.5), this vulner
An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. Rated medium severity (CVSS 4.3), this vulnerabilit
Exploit-DB