ManageEngine Key Manager Plus Improper Access Control

CVE-2026-77777 represents an improper access control vulnerability in ManageEngine Key Manager Plus versions before 7151 that allows authenticated users to modify ACME certificate deployment credentials belonging to other users. This vulnerability is particularly concerning because certificate management systems are critical trust anchors in infrastructure—compromise of ACME credentials can enable attackers to hijack certificate issuance, redirect traffic, or establish persistent access to systems relying on those certificates. Organizations using Key Manager Plus for certificate lifecycle management, particularly those in regulated industries handling sensitive infrastructure, are directly affected. The attack surface is limited to authenticated users, but this is a significant concern in environments where internal user accounts may be compromised or where insider threats exist.

While CVE-2026-77777 does not map to specific MITRE ATT&CK techniques, Casky's security skills powered by Claude AI can detect the attack patterns underlying this vulnerability by analyzing access control anomalies and privilege abuse indicators. Practitioners using Casky would observe findings related to unauthorized credential modification attempts, cross-user access patterns in certificate management logs, and anomalous changes to ACME deployment configurations. Claude's extended reasoning capabilities enable detection of subtle access control bypasses by correlating user activity, privilege escalation attempts, and deviations from expected certificate management workflows. Security teams would identify these patterns through behavioral analysis of authentication logs, API calls to credential repositories, and audit trails showing users accessing resources outside their assigned permissions—ultimately preventing lateral privilege abuse and certificate infrastructure compromise before exploitation occurs.