# CVE-2026-77690: ManageEngine Key Manager Plus command injection in deployment configuration

Source: https://junglewise.ai/threats/cve-2026-77690-zohocorp-manageengine-key-manager-plus-versions-before-7151-were  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-77690 · Severity: high · CVSS 8.8 · Published 2026-11-04

ManageEngine Key Manager Plus is software that manages cryptographic keys and digital certificates for organizations. An authenticated user with certificate deployment privileges can inject arbitrary system commands through specially crafted input when configuring deployment targets, potentially executing commands on the target system with elevated privileges and compromising sensitive certificate infrastructure.

Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-77690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77690 being exploited in the wild.

**How severe is CVE-2026-77690?** High severity, with a CVSS score of 8.8, published 4 November 2026.

**Which products and versions are affected?** Zoho ManageEngine Key Manager Plus All versions until 7150.

**Is there a fix for CVE-2026-77690?** Yes: fixed in 7151. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77690 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-77690?** Check whether you run Zoho ManageEngine Key Manager Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7151

## Technical details

A command injection vulnerability exists in ManageEngine Key Manager Plus in the certificate deployment target configuration functionality. An authenticated attacker with certificate deployment privileges can supply unsanitized input that influences OS command execution on the deployment target, achieving arbitrary command execution with the privileges of the deployment identity. The vulnerability was fixed in version 7151 through input validation and sanitization.

## Affected products

- Zoho ManageEngine Key Manager Plus All versions until 7150

## Timeline

- 2026-11-04: disclosed
- 2026-08-21: patched

## References

- [https://www.manageengine.com/key-manager/advisory/cve-2026-77690.html](https://www.manageengine.com/key-manager/advisory/cve-2026-77690.html)

## Related threats

- [ManageEngine Key Manager Plus improper access control in certificate export](https://junglewise.ai/threats/cve-2026-77778-zohocorp-manageengine-key-manager-plus-versions-up-to-7150-allow)