High-severity command injection flaw in ZohoCorp Key Manager Plus

## Overview ZohoCorp disclosed a high-severity command injection vulnerability affecting ManageEngine Key Manager Plus. This issue exists in versions prior to 7151. Authenticated users with certificate deployment privileges can exploit this vulnerability. ## Technical Details The command injection flaw allows attackers to execute arbitrary commands. This occurs through specially crafted input during the configuration of a deployment target. The vulnerability has a CVSS score of 8.8, indicating its severity. Attackers need valid credentials to exploit this flaw, but once they gain access, they can execute commands on the underlying system. ## Impact Successful exploitation of CVE-2026-77690 can lead to unauthorized actions on the server. This could result in data breaches, system manipulation, or further network compromise. Organizations using affected versions are at risk, especially if they have users with deployment privileges. ## Mitigation Defenders should update to ManageEngine Key Manager Plus version 7151 or later immediately. Regularly review user permissions and limit access to only those who require it. Implement monitoring to detect unusual activity related to command execution. Conduct security assessments to identify and remediate any potential vulnerabilities.