CVE-2026-86708

A hardcoded Google Cloud service-account private key was found in the installer for ManageEngine Applications Manager version 182200 and earlier. The flaw allows any unauthenticated attacker who can access the installer package to extract the key. With the key, an attacker can authenticate as the service account to access or modify associated Google Cloud resources. This is a critical issue because it requires no user interaction and leads to a complete compromise of the linked cloud identity. There is no public proof-of-concept or known in-the-wild exploitation at this time.

What to do: Upgrade ManageEngine Applications Manager to version 1822001 or later to remove the embedded private key. If an upgrade is not immediately possible, audit and rotate any credentials for the affected Google Cloud service account and restrict its permissions.