Skip to content
OpenAdvisories

Product · Zohocorp

DDI Central

12 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • High 8.8
    CVE-2026-19421

    Authenticated Injection

    Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.

    Zohocorp DDI Central
  • High 7.6
    CVE-2026-12266

    Authenticated Broken Access Control

    Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.

    Zohocorp DDI Central
  • High 8.1
    CVE-2026-12574

    Server-Side HTML Injection

    Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.

    Zohocorp DDI Central
  • High 8.8
    CVE-2026-12573

    Authenticated Command Injection

    Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.

    Zohocorp DDI Central
  • High 7.2
    CVE-2026-12572

    SQL Injection

    Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.

    Zohocorp DDI Central
  • High 7.5
    CVE-2026-95651

    Authentication Bypass

    Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.

    Zohocorp DDI Central
  • High 8.0
    CVE-2026-95646

    Authenticated Command Injection

    Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially …

    Zohocorp DDI Central
  • High 8.8
    CVE-2026-12265

    Authenticated Broken Access Control

    Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.

    Zohocorp DDI Central
  • High 8.8
    CVE-2026-12264

    Authenticated Arbitrary File Write

    Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.

    Zohocorp DDI Central
  • High 7.2
    CVE-2026-12267

    Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCE

    ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.

    Zohocorp DDI Central
  • High 8.8
    CVE-2026-12268

    Authenticated PowerShell Injection leads to RCE

    ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.

    Zohocorp DDI Central
  • High 8.8
    CVE-2026-12269

    Authenticated File Write to RCE via keepalived in DDI Central

    Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentiall…

    Zohocorp DDI Central