{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3azohocorpmanageengine_key_manager_plus/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zohocorp:manageengine_key_manager_plus:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":8.1,"id":"CVE-2026-77691"},{"cvss":7.1,"id":"CVE-2026-77778"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=CVE-2026-77691\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["ManageEngine Key Manager Plus (\u003c 7151)","ManageEngine Key Manager Plus (\u003c= 7150)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["ZohoCorp"],"content_html":"\u003cp\u003eCVE-2026-77691 identifies a vulnerability in ZohoCorp ManageEngine Key Manager Plus versions before 7151. The vulnerability allows authenticated users to enter malicious input when configuring a Microsoft CA.\u003c/p\u003e\n","date_modified":"2026-11-03T13:57:33Z","date_published":"2026-11-03T11:58:10Z","id":"https://feed.craftedsignal.io/briefs/2026-11-zoho-key-manager-plus-cve-2026-77691/","summary":"ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA.","title":"ZohoCorp ManageEngine Key Manager Plus: Input validation vulnerability (CVE-2026-77691)","url":"https://feed.craftedsignal.io/briefs/2026-11-zoho-key-manager-plus-cve-2026-77691/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:zohocorp:manageengine_key_manager_plus:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.7,"id":"CVE-2026-77800"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Key Manager Plus (\u003c 7151)"],"_cs_severities":["high"],"_cs_tags":["vulnerability","authentication-bypass","saml"],"_cs_type":"advisory","_cs_vendors":["ManageEngine"],"content_html":"\u003cp\u003eManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass flaw. The vulnerability allows an attacker to gain unauthorized access by submitting a valid SAML assertion intended for a different service provider to the Key Manager Plus application. This bypass circumvents standard authentication mechanisms.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an unauthenticated attacker to bypass authentication and gain unauthorized access to the Key Manager Plus administrative interface.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade ManageEngine Key Manager Plus to version 7151 or later immediately to patch CVE-2026-77800.\u003c/li\u003e\n\u003cli\u003eReview authentication logs for successful logins that originated from unusual sources or show inconsistencies in SAML assertion parameters if your environment utilizes SAML integration.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T11:57:41Z","date_published":"2026-11-03T11:57:41Z","id":"https://feed.craftedsignal.io/briefs/2026-11-manageengine-key-manager-plus-saml-bypass/","summary":"ManageEngine Key Manager Plus versions prior to 7151 contain a SAML authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by presenting crafted SAML assertions.","title":"ManageEngine Key Manager Plus SAML authentication bypass (CVE-2026-77800)","url":"https://feed.craftedsignal.io/briefs/2026-11-manageengine-key-manager-plus-saml-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:zohocorp:manageengine_key_manager_plus:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}