Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

ManageEngine Key Manager Plus can run unauthorized commands

CVE-2026-77690 · published today
Summary

If a user who can deploy certificates logs into ManageEngine Key Manager Plus (versions before 7151), they could craft input that makes the system run any command they choose. This could let them take control of the server hosting the software. Update to version 7151 or later to stop this behavior.

What to do
  • Update zohocorp manageengine key manager plus to version 7151 or later.
Affected software
VendorProductAffected versions
zohocorp manageengine key manager plus < 7151
Original advisory text
Command injection vulnerability
ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
16% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published4 Nov 2026
Updated4 Nov 2026
First seen4 Nov 2026
Sources
CVE-2026-77690 · NVD
CVE-2026-77690 · MITRE
Track software like this
Free during beta