CVE-2026-77778

HighCVSS 7.1/10Last modified Nov 3, 2026

Description

ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-1220

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
ZohocorpManageEngine Key Manager Plus< 7151

References

Timeline

Published
Nov 3, 2026
Last modified
Nov 3, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-777797.7ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated loCVE-2026-77785.0An issue that could allow a dashboard configuration to be viewed from outside of the authorized organization scope has been resolved. This iCVE-2026-777805.3Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a CVE-2026-777817.5Tie::Hash::Regex versions before 2.0.0 for Perl will throw an exception on unparseable lookup keys. The FETCH, EXISTS and DELETE methods thCVE-2026-777825.3The Rank Math SEO WordPress plugin before 1.0.277.1 does not check whether a post is password protected before using its content to build pCVE-2026-777833.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the post whose schema it renders on the front end is publicly viewabCVE-2026-777842.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that a user is allowed to edit the object being modified before updating CVE-2026-777852.7The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the requesting user is permitted to read the specific post referenceCVE-2026-777864.9The Rank Math SEO WordPress plugin before 1.0.277 does not check that the user requesting an automated SEO fix holds the capability WordPreCVE-2026-777872.7The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, andCVE-2026-777884.9The Rank Math SEO WordPress plugin before 1.0.277 does not verify that the metadata row being updated belongs to the object the user was auCVE-2026-777894.3The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.1 does not verify that a subscription belongs to the customer bound to
CVE-2026-77778: High severity, CVSS 7.1 | Vulnix