Zoho Corp Ddi Central
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Zoho Corp Ddi Central.
By the Year
In 2026 there have been 17 vulnerabilities in Zoho Corp Ddi Central with an average score of 8.3 out of ten.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 17 | 8.27 |
It may take a day or so for new Ddi Central vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Zoho Corp Ddi Central Security Vulnerabilities
CVE-2026-75869: ManageEngine DDI Central Auth Bypass & PowerShell Injection
CVE-2026-75869
8.8 - High
- November 12, 2026
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.
Shell injection
ManageEngine DDI Central Auth Bypass Allows Unauthorized DHCP Option Change
CVE-2026-75868
8.1 - High
- November 12, 2026
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.
AuthZ
Auth Bypass in ManageEngine DDI Central allows DHCP filter modification
CVE-2026-75867
8.1 - High
- November 12, 2026
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.
AuthZ
ManageEngine DDI Central AuthZ Bypass Leads to DNS Zone Deletion
CVE-2026-75864
8.1 - High
- November 12, 2026
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.
AuthZ
Auth Bypass in ManageEngine DDI Central Win DNS/DHCP Sync
CVE-2026-19422
9.1 - Critical
- November 12, 2026
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.
Missing Authentication for Critical Function
PowerShell Injection in ManageEngine DDI Central <6301 (Zoho)
CVE-2026-19421
8.8 - High
- November 12, 2026
Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.
Shell injection
ManageEngine DDI Central LDAP Bind Password Exposure (CVE-2026-12266)
CVE-2026-12266
7.6 - High
- November 10, 2026
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.
AuthZ
Zoho ManageEngine DDI Central HTML/JS Injection in PDF Analytics
CVE-2026-12574
8.1 - High
- November 10, 2026
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.
XSS
CVE-2026-12573: ManageEngine DDI Central DHCP Pool Command Injection (Cisco IOS)
CVE-2026-12573
8.8 - High
- November 10, 2026
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.
Command Injection
Zoho ManageEngine DDI Central SQLi in HA Replication Username
CVE-2026-12572
7.2 - High
- November 10, 2026
Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.
SQL Injection
Zoho ManageEngine DDI Central <=6500 Unauth GSSTSIG Keytab Update (Linux Agent)
CVE-2026-95651
7.5 - High
- November 10, 2026
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.
Missing Authentication for Critical Function
Unicode Command Injection in ManageEngine DDI Central 6500
CVE-2026-95646
8 - High
- November 10, 2026
Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.
Command Injection
Zohocorp DDI Central: HA Failover Endpoint ACL Flaw Enables Destructive DB Ops
CVE-2026-12265
8.8 - High
- September 28, 2026
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
Authorization
Arbitrary File Write in ManageEngine DDI Central (pre-6201) RCE
CVE-2026-12264
8.8 - High
- September 28, 2026
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.
Unrestricted File Upload
ManageEngine DDI Central RCE via Windows DNS Query Injection
CVE-2026-12267
7.2 - High
- September 28, 2026
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.
Improper Input Validation
PowerShell Command Injection in ManageEngine DDI Central DNS SPF/TXT Push
CVE-2026-12268
8.8 - High
- September 28, 2026
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution.
Improper Input Validation
Keepalived Config Injection in Zoho DDI Central <6.2.0 build 6201
CVE-2026-12269
8.8 - High
- September 28, 2026
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
Unrestricted File Upload
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Zoho Corp Ddi Central or by Zoho Corp? Click the Watch button to subscribe.
