Auth Bypass in ManageEngine DDI Central Pwd Reset Flow
CVE-2026-12571 Published on August 11, 2026
Authentication Bypass Leading to Account Takeover
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
Vulnerability Analysis
CVE-2026-12571 can be exploited with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be critical as this vulnerability has a high impact to the confidentiality, integrity and availability of this component.
Weakness Types
What is an authentification Vulnerability?
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CVE-2026-12571 has been classified to as an authentification vulnerability or weakness.
Weak Password Recovery Mechanism for Forgotten Password
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
Products Associated with CVE-2026-12571
Want to know whenever a new CVE is published for Zoho Corp Manageengine Ddi Central? stack.watch will email you.
Affected Versions
zohocorp manageengine_ddi_central:- Before 6201 is affected.