Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 631

Export CSV
CVE-2026-77690

Command injection vulnerability

ZohoCorp ManageEngine Key Manager Plus versions before 7151 were vulnerable to a Command Injection vulnerability that allowed authenticated users with certificate deployment privileges to execute arbitrary commands through specially crafted input when configuring a deployment target.

CVSS 3.1 · 8.8 High EPSS 15.6% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Key Manager Plus
CVE-2026-77779

Improper access control vulnerability

ManageEngine Key Manager Plus versions before 7151 were vulnerable to an Improper Access Control vulnerability that allowed authenticated low-privilege users to export keys outside their authorized scope.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Key Manager Plus
CVE-2026-77799

Two-factor authentication bypass

ManageEngine Key Manager Plus versions before 7150 are vulnerable to a Two-Factor Authentication bypass that allows attackers with valid credentials to log in without a verification code.

CVSS 3.1 · 7.4 High EPSS 1.2% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Key Manager Plus
CVE-2026-77777

Improper access control vulnerability

ManageEngine Key Manager Plus versions before 7151 are vulnerable to an improper access control issue that allow authenticated users to modify another user's ACME certificate deployment credentials.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Key Manager Plus
CVE-2026-77800

Authentication bypass vulnerability

ManageEngine Key Manager Plus versions before 7151 are vulnerable to a SAML authentication bypass that allows attackers to log in using SAML assertions meant for another service provider.

CVSS 3.1 · 7.7 High EPSS < 1% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Key Manager Plus
CVE-2026-16900

Authentication Bypass

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed
Vendors
Zohocorp
Products
Eventlog Analyzer Log360 Manageengine Eventlog Analyzer
CVE-2026-77778

Improper access control vulnerability

ZohoCorp ManageEngine Key Manager Plus versions up to 7150 allow authenticated users to export certificates belonging to other users to their own registered key vaults.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Key Manager Plus
CVE-2026-77691

Command injection vulnerability

ZohoCorp ManageEngine Key Manager Plus versions before 7151 allow authenticated users to enter malicious input when configuring a Microsoft CA

CVSS 3.1 · 8.1 High EPSS 1.4% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Key Manager Plus
CVE-2026-14308

Insufficient Signature Validation

Zohocorp ManageEngine Malware Protection Plus versions before 1.0.64.12 are affected by insufficient driver signature validation in MEARWService.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Malware Protection Plus
CVE-2026-12269

Authenticated File Write to RCE via keepalived in DDI Central

Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.

CVSS 3.1 · 8.8 High EPSS 7.0% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-12268

Authenticated PowerShell Injection leads to RCE

ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.

CVSS 3.1 · 8.8 High EPSS 4.7% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-12267

Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.

CVSS 3.1 · 7.2 High EPSS 3.6% KEV · Not listed
Vendors
Zohocorp
Products
Ddi Central
CVE-2026-86708

Sensitive data exposure

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

CVSS 3.1 · 10 Critical EPSS 2.7% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Applications Manager
CVE-2026-86679

Broken Access Control vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below were vulnerable to a permissions validation issue that allowed a low-privileged user to delete service monitors outside their assigned scope.

CVSS 3.1 · 7.1 High EPSS 1.9% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Applications Manager
CVE-2026-86677

Broken Authentication vulnerability

ZohoCorp ManageEngine Applications Manager versions 182000 and below allowed a low-privileged user to run unauthorized SQL commands, potentially gaining administrator access and remote code execution.

CVSS 3.1 · 8.8 High EPSS 5.1% KEV · Not listed
Vendors
Zohocorp
Products
Manageengine Applications Manager