CVE-2026-77799

{
  "etk_id": "ETK-2026-3345",
  "cve_id": "CVE-2026-77799",
  "display_id": "CVE-2026-77799",
  "ghsa_id": "GHSA-7g56-c8wh-g2wc",
  "euvd_id": "EUVD-2026-115674",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Two-factor authentication bypass in Key Manager Plus",
  "summary": "ManageEngine Key Manager Plus releases before 7150 do not reliably enforce the second authentication factor. An attacker who already has valid account credentials may be able to sign in without completing verification-code validation.",
  "mitigation": "Upgrade ManageEngine Key Manager Plus to version 7150 or later. Until the upgrade is complete, limit access to the service to trusted networks and review account access for unexpected sign-ins.",
  "vendor": "Zohocorp",
  "product": "ManageEngine Key Manager Plus",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 7151"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "7151"
      ],
      "package_name": "ManageEngine Key Manager Plus",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.4,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 68.59215838333333,
  "t0_at": "2026-11-03T04:57:12.810000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-03T08:26:41.394153+00:00",
      "days": 0.14546972399305555,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T04:57:12.810000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-03T04:57:12.810000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-03T04:57:12.810000+00:00",
      "url": "https://github.com/advisories/GHSA-7g56-c8wh-g2wc"
    }
  }
}