CVE-2026-86708

ZohoCorp ManageEngine Applications Manager versions 182200 and below were vulnerable to exposure of a Google Cloud service-account private key in the Applications Manager installer, which could allow an unauthenticated attacker to impersonate the service account and access or modify associated cloud resources.

  • Published Sep 23, 2026
  • CVSS 10.0 critical
  • 1.2% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-86708 at the National Vulnerability Database