# CVE-2026-77779: ManageEngine Key Manager Plus improper access control in certificate export

Source: https://junglewise.ai/threats/cve-2026-77779-manageengine-key-manager-plus-versions-before-7151-were  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-77779 · Severity: high · CVSS 7.7 · Published 2026-11-04

ManageEngine Key Manager Plus is a cryptographic key and certificate management system used to secure and control digital assets across enterprises. A vulnerability in versions before 7151 allowed authenticated users with limited privileges to export cryptographic keys and certificates belonging to other users, enabling account impersonation and fraudulent digital signatures.

Technologies: [ManageEngine Key Manager Plus](https://junglewise.ai/threats/technologies/key-manager-plus). Vendors: [ManageEngine](https://junglewise.ai/threats/vendors/manageengine).

## Quick answers

**Is CVE-2026-77779 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-77779 being exploited in the wild.

**How severe is CVE-2026-77779?** High severity, with a CVSS score of 7.7, published 4 November 2026.

**Which products and versions are affected?** ManageEngine Key Manager Plus before 7151.

**Is there a fix for CVE-2026-77779?** Yes: fixed in 7151. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-77779 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-77779?** Check whether you run ManageEngine Key Manager Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 7151

## Technical details

An improper access control vulnerability in ManageEngine Key Manager Plus allows authenticated low-privilege users to export private keys and certificates outside their authorization scope by bypassing certificate request validation. The vulnerability exists in agent-initiated certificate request handling, where insufficient authorization checks permitted cross-user key access. The fix enforces stringent authorization checks to ensure agents can only operate within the scope of their registering user.

## Affected products

- ManageEngine Key Manager Plus before 7151

## Timeline

- 2026-11-04: disclosed
- 2026-08-21: patched

## References

- [https://www.manageengine.com/key-manager/advisory/cve-2026-77779.html](https://www.manageengine.com/key-manager/advisory/cve-2026-77779.html)

## Related threats

- [ManageEngine Key Manager Plus improper access control](https://junglewise.ai/threats/cve-2026-77777-manageengine-key-manager-plus-versions-before-7151-are-vulnerable)
- [ManageEngine Key Manager Plus SAML authentication bypass](https://junglewise.ai/threats/cve-2026-77800-manageengine-key-manager-plus-versions-before-7151-are-vulnerable)
- [ManageEngine Key Manager Plus two-factor authentication bypass](https://junglewise.ai/threats/cve-2026-77799-manageengine-key-manager-plus-versions-before-7150-are-vulnerable)