Vulnerability · Published Nov 4, 2026 · Assigned by Zohocorp
CVE-2026-77690Command injection vulnerability
High 8.8
In plain English
A high-severity OS command injection in ManageEngine Key Manager Plus from Zohocorp. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 15.6% (higher than 97% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)15.6%top 3.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | ManageEngine Key Manager Plus | 0 – before 7151 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H