CriticalCritical vulnerability

CVE-2026-86708 (CVSS 10.0)

NVD · officialPublished Sep 23, 2026Risk 50/100EPSS 1.2%

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

Technical details

CVSS

10.0

AV:NetworkAC:LowPR:NoneUI:NoneC:HighI:HighA:None

Evidence and sources

This record is attributed to NVD. Exploitation status and remediation guidance are kept separate from the vulnerability's technical severity.

Open primary source