CVE-2026-86708CWE-321

CVE-2026-86708

Critical · published September 23, 2026

CVSS v3.1
10.0
EPSS
1%
Percentile
69.0
In the wild
Unconfirmed
What it is

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01244 · 69.0th percentile
Weakness
CWE-321 · Use of Hard-coded Cryptographic Key
Published
2026-09-23T18:17Z
References (1)
https://www.manageengine.com/products/applications_manager/security-updates/security-updates-cve-2026-86708.html · 0fc0942c-577d-436f-ae8e-945763c79b02
EPSS history
Timeline
  • 25 SEP 03:28Z
    EPSS moved — → 1%
    epss
  • 23 SEP 13:11Z
    Sensitive data exposure
    cvelistv5