Key Manager Plus EUVD-2026-115675

Requires that SAML single sign-on is configured and enabled on Key Manager Plus and that the instance shares an identity provider (or trusts assertions) with at least one other service provider. The concrete prerequisite is that the attacker must possess a valid SAML assertion that the IdP issued for a DIFFERENT service provider; Key Manager Plus before 7151 fails to validate that the assertion's intended audience/recipient is itself, so it accepts the misdirected assertion. Limiting factors: exploitation is impossible on instances not using SAML SSO; the attacker must first acquire a genuine assertion from the trusted IdP (reflected in CVSS AC:H), which is not attacker-generated out of thin air. The vendor fix is upgrading to version 7151 or later.

This is a genuine, vendor-confirmed authentication bypass (CVE-2026-77800, CWE-304) in ManageEngine Key Manager Plus, but the signals point to a scheduled-remediation priority rather than an emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:L) describes a remote, unauthenticated flaw with high attack complexity, yielding a 7.7 base score. The 'this_week' decision label from vuln.today aligns with that: serious, but not act_now/emergency. No EPSS score, no CISA KEV listing, and no public PoC or exploit reference were supplied, so there is no evidence of active or imminent mass exploitation - the AC:H rating is consistent with a bypass that is not trivially automatable because the attacker must first obtain a valid SAML assertion. The main caveat: EPSS is absent (not an error, just unavailable), so exploitation probability cannot be quantified, and the only source is the vendor advisory itself, so independent corroboration of the fix and affected range is not yet available. Treat as a high-value target (it guards cryptographic keys) warranting prompt patching, but current data does not support treating it as under active attack.

An attacker who can obtain a SAML assertion legitimately issued by the shared identity provider for a different service provider replays that assertion against Key Manager Plus, which fails to verify that the assertion's intended audience/recipient matches itself. The assertion is accepted and the attacker is logged in as the corresponding user, gaining access to the key-management console. No public exploit code or PoC reference was provided in the available data.