DDI Central vulnerabilities

17 known vulnerabilities in DDI Central from Zoho. 17 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  DDI Central: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-75869Nov 12, 2026ZohoEPSS 20.4%

  Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute

• 8.1 High severity

  DDI Central: Incorrect Authorization

  CVE-2026-75868Nov 12, 2026ZohoEPSS 1.12%

  Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.

• 8.1 High severity

  DDI Central: Incorrect Authorization

  CVE-2026-75867Nov 12, 2026ZohoEPSS 1.12%

  Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.

• 8.1 High severity

  DDI Central: Missing Authorization

  CVE-2026-75864Nov 12, 2026ZohoEPSS 1.02%

  Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.

• 9.1 Critical severity

  DDI Central: Missing Authentication for Critical Functionality

  CVE-2026-19422Nov 12, 2026ZohoEPSS 2.19%

  Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS

• 8.8 High severity

  DDI Central: Improper Neutralization of Special Elements used in an OS Command

  CVE-2026-19421Nov 12, 2026ZohoEPSS 2.47%

  Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.

• 8.1 High severity

  DDI Central: Improper Neutralization of Input During Web Page Generation

  CVE-2026-12574Nov 10, 2026Zoho

  Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.

• 8.8 High severity

  DDI Central: Improper Neutralization of Special Elements used in a Command

  CVE-2026-12573Nov 10, 2026ZohoEPSS 3.15%

  Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.

• 7.2 High severity

  DDI Central: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-12572Nov 10, 2026ZohoEPSS 3.37%

  Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.

• 7.6 High severity

  DDI Central: Missing Authorization

  CVE-2026-12266Nov 10, 2026Zoho

  Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.

• 7.5 High severity

  DDI Central: Missing Authentication for Critical Functionality

  CVE-2026-95651Nov 10, 2026ZohoEPSS 1.32%

  Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.

• 8.0 High severity

  DDI Central: Improper Neutralization of Special Elements used in a Command

  CVE-2026-95646Nov 10, 2026ZohoEPSS 3.88%

  Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially c

• 8.8 High severity

  DDI Central: Improper Access Control

  CVE-2026-12265Sep 28, 2026Zoho

  Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.

• 8.8 High severity

  DDI Central: Unrestricted Upload of File with Dangerous Type

  CVE-2026-12264Sep 28, 2026ZohoEPSS 1.61%

  Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.

• 8.8 High severity

  DDI Central: Improper Privilege Management

  CVE-2026-12269Sep 28, 2026ZohoEPSS 6.99%

  Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially

• 8.8 High severity

  ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in…

  CVE-2026-12268Sep 28, 2026ZohoEPSS 4.73%

  ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.

• 7.2 High severity

  ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows…

  CVE-2026-12267Sep 28, 2026ZohoEPSS 3.6%

  ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.