Is CVE-2026-77778 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77778 being exploited in the wild.

How severe is CVE-2026-77778?

High severity, with a CVSS score of 7.1, published 3 November 2026.

Which products and versions are affected?

Zoho ManageEngine Key Manager Plus up to 7150.

Is there a fix for CVE-2026-77778?

Yes: fixed in 7151. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-77778 attacked?

It is attacked over the network.

Am I affected by CVE-2026-77778?

Check whether you run Zoho ManageEngine Key Manager Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77778: ManageEngine Key Manager Plus improper access control in certificate export

CVE-2026-77778 · Severity: high · CVSS 7.1 · Published 2026-11-03

ManageEngine Key Manager Plus is a centralized system for managing cryptographic certificates and keys used to secure communications and authenticate systems. An authenticated user could exploit improper access controls to export certificates and private keys belonging to other users, enabling account impersonation and unauthorized access to protected resources. This affects all versions up to 7150 and has been fixed in version 7151.

Vendors: Zoho.

Quick answers

Is CVE-2026-77778 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77778 being exploited in the wild.
How severe is CVE-2026-77778?: High severity, with a CVSS score of 7.1, published 3 November 2026.
Which products and versions are affected?: Zoho ManageEngine Key Manager Plus up to 7150.
Is there a fix for CVE-2026-77778?: Yes: fixed in 7151. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77778 attacked?: It is attacked over the network.
Am I affected by CVE-2026-77778?: Check whether you run Zoho ManageEngine Key Manager Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 7151

Technical details

An improper access control vulnerability allows authenticated users with certificate management privileges to export certificates and associated private keys belonging to other users to their own registered key vaults without proper authorization checks. The vulnerability requires authentication and valid certificate management privileges. The fix validates the requesting user's access rights against the selected certificate before allowing export.

Affected products

Zoho ManageEngine Key Manager Plus up to 7150

Timeline

2026-11-03: disclosed
2026-08-21: patched: Fixed version 7151 released

References

https://www.manageengine.com/key-manager/advisory/cve-2026-77778.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.