Authenticated Certificate Export Across User Boundaries

CVE-2026-77778 affects ZohoCorp ManageEngine Key Manager Plus through version 7150, enabling authenticated users to export certificates belonging to other users into their own key vaults. This is a privilege escalation and data exfiltration vulnerability rooted in insufficient access controls (CWE-1220: Improper Restriction of Rendered UI Layers or Frames). Organizations managing cryptographic material through Key Manager Plus face significant risk, as compromised user accounts—whether through credential theft, insider threats, or social engineering—can be leveraged to extract sensitive certificates without authorization. This is particularly dangerous in regulated industries (finance, healthcare, government) where certificate compromise could enable man-in-the-middle attacks, fraudulent signing, or unauthorized system impersonation. Any organization running affected versions with multiple users accessing the platform should consider this a critical control gap.

While this CVE currently maps to zero Casky skills due to its reliance on vendor-specific access control bypass patterns, practitioners using Casky's platform would detect attack precursors through behavioral anomalies: unexpected certificate exports, cross-user resource access attempts, and privilege boundary violations. Casky's Claude AI-driven analysis would flag these patterns against authorization policies and data access logs, particularly around T1087 (Account Discovery) and T1020 (Automated Exfiltration) when correlating with suspicious export activities. Organizations should prioritize patching to version 7151+ and implement detective controls monitoring certificate operations, including who exports what and to which vault—filling the gap where this vulnerability exists until remediation is complete.