Key Manager Plus CVE-2026-77799

The attacker must already possess valid login credentials for a ManageEngine Key Manager Plus account, and the targeted account/instance must have Two-Factor Authentication enabled (there is no second factor to bypass otherwise). Only builds before 7150 are affected. The flaw lets the attacker complete login while skipping the verification-code step. Limiting factors: exploitation is gated on prior credential compromise (so 2FA no longer provides defense-in-depth against stolen passwords) and on the deployment running a pre-7150 build; the vendor's AC:H rating further implies the bypass is not trivially reliable, though the available sources do not state how it is triggered.

This is a moderate-priority issue rather than an emergency. The vendor-assigned CVSS of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and the 'this_week' decision label point to meaningful but not top-tier urgency. A significant signal conflict exists and must be verified: the CVSS vector states PR:N (no privileges required), yet the description explicitly says exploitation requires 'attackers with valid credentials' - these contradict each other, and the credential requirement in the description is the more specific, mechanism-level claim. This is a 2FA-bypass (CWE-288), so the real-world precondition is possession of valid first-factor credentials, which materially lowers risk versus a true unauthenticated bypass. No EPSS score, no KEV listing, and no PoC/exploit reference were provided, so there is no public evidence of exploitation. The AC:H in the vendor vector suggests the bypass is not trivially repeatable, though the available sources do not describe how the flaw is triggered. Net: credible and worth remediating promptly for anyone running Key Manager Plus with 2FA enabled, but the credential prerequisite and absence of exploitation signals argue against treating it as a drop-everything emergency.

An attacker who has obtained valid Key Manager Plus account credentials (for example via phishing, credential stuffing, or reuse) initiates a login and bypasses the second-factor verification step, completing authentication without supplying a valid code. This defeats the 2FA control that would otherwise have blocked the compromised-password login, granting full access to the account. No public exploit identified at time of analysis.