ManageEngine Key Manager Plus vulnerabilities

7 known vulnerabilities in ManageEngine Key Manager Plus from Zoho. 7 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  ManageEngine Key Manager Plus: Insufficient Granularity of Access Control

  CVE-2026-77779Nov 4, 2026Zoho

  ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.

• 8.8 High severity

  ManageEngine Key Manager Plus: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-77690Nov 4, 2026ZohoEPSS 15.6%

  ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configur

• 7.1 High severity

  ManageEngine Key Manager Plus: Insufficient Granularity of Access Control

  CVE-2026-77778Nov 3, 2026Zoho

  ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.

• 7.1 High severity

  ManageEngine Key Manager Plus: Insufficient Granularity of Access Control

  CVE-2026-77777Nov 3, 2026Zoho

  ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.

• 7.7 High severity

  ManageEngine Key Manager Plus: Missing Critical Step in Authentication

  CVE-2026-77800Nov 3, 2026Zoho

  ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.

• 7.4 High severity

  ManageEngine Key Manager Plus: Authentication Bypass Using an Alternate Path or Channel

  CVE-2026-77799Nov 3, 2026ZohoEPSS 1.18%

  ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.

• 9.8 Critical severity

  Zoho ManageEngine Multiple Products Remote Code Execution Exploited

  CVE-2022-47966Jan 18, 2023ZohoEPSS 99.8%

  Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the a