CVE-2026-86708: ManageEngine Applications Manager Info Leak

CVE-2026-86708 Overview

CVE-2026-86708 affects ZohoCorp ManageEngine Applications Manager versions 182200 and below. The installer ships with an embedded Google Cloud service-account private key. An unauthenticated attacker who obtains the installer can extract the key and impersonate the associated service account. This impersonation grants access to any Google Cloud resources bound to that identity, including read and modify operations. The vulnerability maps to [CWE-321: Use of Hard-coded Cryptographic Key].

Critical Impact
An attacker can impersonate a Google Cloud service account without authentication, accessing or modifying cloud resources tied to the exposed credential.

Affected Products

ZohoCorp ManageEngine Applications Manager version 182200
All prior ManageEngine Applications Manager releases below 182200
Google Cloud resources bound to the exposed service-account identity

Discovery Timeline

2026-09-23 - CVE-2026-86708 published to the National Vulnerability Database (NVD)
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-86708

Vulnerability Analysis

The Applications Manager installer package bundles a Google Cloud service-account private key as part of its distributed artifacts. Any party that downloads the installer holds the material required to authenticate as that service account. Google Cloud service-account keys are long-lived JSON credentials that identify a non-human principal within a Google Cloud project. When a key of this type is exposed publicly, it functions as a static credential that bypasses interactive authentication and multi-factor controls.

The scope of access depends on the Identity and Access Management (IAM) roles bound to the compromised service account. Broad roles such as roles/editor or project-level custom roles would expose storage buckets, compute workloads, and configuration data. The CVSS scope change indicates the impact crosses the ManageEngine trust boundary into the Google Cloud environment.

Root Cause

The root cause is a hard-coded cryptographic key shipped inside a redistributable software artifact. The installer treats the private key as a static resource rather than provisioning it per-tenant or fetching it through a credential broker at runtime. Anyone with read access to the installer can locate and extract the key file from the package contents.

Attack Vector

An unauthenticated attacker downloads the ManageEngine Applications Manager installer, unpacks it, and locates the embedded Google Cloud service-account JSON key. The attacker then authenticates to Google Cloud APIs using standard tooling such as gcloud auth activate-service-account or the Google Cloud client libraries. From that point, all API calls run under the identity and IAM bindings of the exposed service account. No interaction with the ManageEngine deployment itself is required. Refer to the ManageEngine Security Advisory for CVE-2026-86708 for vendor technical detail.

Detection Methods for CVE-2026-86708

Indicators of Compromise

Google Cloud Audit Log entries showing authentication events for the ManageEngine-associated service account from IP addresses outside the expected administrative range.
API calls to Google Cloud services using the exposed service-account key from user agents inconsistent with ManageEngine Applications Manager runtime behavior.
Unexpected iam.serviceAccounts.getAccessToken or resource enumeration calls (storage.buckets.list, compute.instances.list) tied to the service account principal.

Detection Strategies

Review Google Cloud IAM to enumerate all service accounts whose keys were embedded in third-party installers, then inspect the last 90 days of authentication events.
Correlate Google Cloud Audit Logs with known ManageEngine host IPs and flag any principal activity originating from unrecognized sources.
Scan internal software repositories, backup shares, and endpoint filesystems for installer archives containing .json files matching Google service-account key structure (private_key, client_email, token_uri fields).

Monitoring Recommendations

Enable Google Cloud Audit Logs (Admin Activity and Data Access) for all projects that expose the service account and forward them to a centralized analytics tier.
Alert on any use of long-lived service-account keys, prioritizing those tied to third-party vendor installers.
Continuously monitor for new service-account key creation and unusual role bindings applied to accounts associated with ManageEngine.

How to Mitigate CVE-2026-86708

Immediate Actions Required

Revoke and delete the exposed Google Cloud service-account key immediately through the Google Cloud Console or gcloud iam service-accounts keys delete.
Rotate any dependent credentials and audit IAM bindings on the affected service account to enforce least privilege.
Upgrade ManageEngine Applications Manager to the fixed release published by ZohoCorp above version 182200.
Review Google Cloud Audit Logs for suspicious activity attributed to the exposed principal since installer distribution.

Patch Information

ZohoCorp has released a security update for ManageEngine Applications Manager that removes the exposed credential. Administrators should apply the update referenced in the ManageEngine Security Advisory for CVE-2026-86708 and confirm the installed build reports a version higher than 182200.

Workarounds

Disable the affected Google Cloud service account entirely if the integration is not in active use.
Restrict IAM bindings on the service account to the minimum roles required, removing broad permissions such as roles/editor or roles/owner.
Constrain service-account usage with IAM Conditions or VPC Service Controls to limit calls to expected source networks.

bash

# Revoke exposed key and audit remaining keys
gcloud iam service-accounts keys list \
  --iam-account=SERVICE_ACCOUNT_EMAIL

gcloud iam service-accounts keys delete KEY_ID \
  --iam-account=SERVICE_ACCOUNT_EMAIL

# Optionally disable the service account pending review
gcloud iam service-accounts disable SERVICE_ACCOUNT_EMAIL