CVE-2026-77691
Received Received - Intake

Authenticated Microsoft CA Input Validation Flaw in Key Manager Plus

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: ManageEngine

Description
ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-77691
EUVD
EUVD-2026-115735

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Zohocorp ManageEngine Key Manager Plus 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-77691 is a high-severity command injection vulnerability in ZohoCorp ManageEngine Key Manager Plus versions before 7151. It allows authenticated users with certificate management privileges to execute arbitrary OS commands on a Windows endpoint where the certificate agent is installed. The issue stems from improper input validation during certificate revocation when configuring a Microsoft CA.

Impact Analysis

An attacker with access could execute malicious commands on the affected system, potentially leading to unauthorized data access, system compromise, or further network infiltration. The impact depends on the privileges of the certificate agent service.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements such as GDPR or HIPAA. Organizations must address it to maintain data protection standards and avoid potential regulatory penalties.

Mitigation Strategies

Upgrade to ManageEngine Key Manager Plus version 7151 or later by downloading the latest upgrade pack from the official ManageEngine website and applying it according to the provided instructions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-77691. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...