CVE-2026-77778 in ManageEngine Key Manager Plus
Summary
by MITRE • 11/03/2026
ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/03/2026
The vulnerability identified in ZohoCorp ManageEngine Key Manager Plus, specifically affecting versions up to build 7150, represents a critical failure in access control mechanisms within the application's certificate management subsystem. This flaw allows authenticated users to perform actions that should be strictly restricted by their assigned roles and permissions. Specifically, an attacker who has obtained valid credentials for any user account can exploit this logic error to export certificates belonging to other users into key vaults registered under their own account. This behavior indicates a fundamental breakdown in the principle of least privilege and proper object-level authorization checks within the software's backend processing logic.
From a technical perspective, the vulnerability stems from insufficient validation of ownership or permission rights when handling certificate export requests. When an authenticated user initiates an export operation for a specific digital certificate, the application fails to verify that the requesting user has explicit administrative privileges over that particular resource. Instead, it appears to rely on general authentication status rather than enforcing granular access controls defined by the system's role-based access control model. This oversight enables lateral movement within the identity management infrastructure, as one compromised or maliciously configured low-privilege account can effectively assume higher-level capabilities regarding sensitive cryptographic materials without escalating privileges through traditional means such as exploiting a separate privilege escalation flaw.
The operational impact of this vulnerability is severe due to the sensitivity of the data involved. Digital certificates are foundational components of public key infrastructure and secure communications, often used for code signing, server authentication, email encryption, and client identification. By exporting these certificates along with their associated private keys if applicable or gaining access to them in a manner that facilitates misuse, an attacker can impersonate legitimate services, intercept encrypted traffic through man-in-the-middle attacks, or forge digital signatures. This compromises the integrity and confidentiality of systems relying on ManageEngine Key Manager Plus for certificate lifecycle management. Furthermore, it undermines trust within organizational security postures by allowing unauthorized entities to manipulate identity assets that are critical for secure network operations.
This type of flaw is commonly categorized under CWE-269: Improper Privilege Assignment or CWE-862: Missing Authorization in the Common Weakness Enumeration framework. In terms of tactical classification, it aligns with ATT&CK technique T1078: Valid Accounts, where adversaries leverage legitimate credentials to access resources they are not authorized to use, and potentially T1553: Subvert Trust Controls if the exported certificates are used to bypass security mechanisms like code signing verification. The ability to move laterally between user accounts by misusing certificate export functions highlights a significant gap in internal segmentation of duties within the application's architecture.
Mitigation strategies should prioritize immediate patching to the latest version released by ZohoCorp, which addresses these authorization checks. Organizations currently running versions up to 7150 must apply vendor-provided updates as soon as possible to close this access control loophole. In addition to software remediation, administrators should review and tighten role-based access policies within ManageEngine Key Manager Plus, ensuring that export capabilities are restricted only to users with explicit administrative responsibilities for certificate management. Implementing multi-factor authentication for all accounts accessing the platform adds an additional layer of defense against credential theft. Regular audits of user activity logs can help detect any unauthorized attempts to export certificates belonging to other users, providing early warning indicators of potential exploitation or insider threats attempting to abuse this vulnerability.