ManageEngine Key Manager Plus SAML authentication bypass (CVE-2026-77800)
ManageEngine Key Manager Plus versions prior to 7151 contain a SAML authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by presenting crafted SAML assertions.
CVE search metadata
CVE search record: CVE-2026-77800. Severity: high. CVSS: 7.7. KEV: no. Product: Key Manager Plus (< 7151). Brief: ManageEngine Key Manager Plus SAML authentication bypass (CVE-2026-77800). Brief link: https://feed.craftedsignal.io/briefs/2026-11-manageengine-key-manager-plus-saml-bypass/
Triage facts
Revision 1- Applicability
- Key Manager Plus (< 7151)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 3, 11:57 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass flaw. The vulnerability allows an attacker to gain unauthorized access by submitting a valid SAML assertion intended for a different service provider to the Key Manager Plus application. This bypass circumvents standard authentication mechanisms.
Impact
Successful exploitation allows an unauthenticated attacker to bypass authentication and gain unauthorized access to the Key Manager Plus administrative interface.
Recommendation
- Upgrade ManageEngine Key Manager Plus to version 7151 or later immediately to patch CVE-2026-77800.
- Review authentication logs for successful logins that originated from unusual sources or show inconsistencies in SAML assertion parameters if your environment utilizes SAML integration.
Immediate actions
Upgrade ManageEngine Key Manager Plus to version 7151 or later
Threat Hunt
Hunt for authentication events originating from non-standard SAML identity providers or unexpected Service Provider (SP) identifier mismatch in Key Manager Plus application logs
Data: Key Manager Plus application access/audit logs
Mitigations
Upgrade to version 7151
CVE-2026-77800