EUVD-2026-88226
GHSA-jf5j-gcwm-85w2
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege DDI Central credentials
-
DeliveryAccess HA Failover config-sync upload
-
ExploitWrite malicious file to controlled path
-
ExecutionTrigger execution of written file
-
ImpactAchieve remote code execution on server
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated low-privilege account (PR:L) on the ManageEngine DDI Central management console and access to the HA (High Availability) Failover configuration-sync upload functionality - so the High Availability feature/deployment mode must be reachable. Exploitation is remote and network-based (AV:N) with low complexity (AC:L) and no user interaction (UI:N), but is limited to instances running versions before build 6201 where the attacker can reach the HA config-sync upload endpoint with valid credentials. Patched by upgrading to build 6201 or later. |
| Impact | The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication (PR:L) and no user interaction, yielding full confidentiality, integrity, and availability impact via arbitrary-file-write-to-RCE - a genuinely serious combination for an infrastructure-management product. However, the exploitation-probability signals are thin: no EPSS score is provided, the CVE is NOT in CISA KEV, and no public POC is referenced (the only reference is the ManageEngine security-updates advisory). Exploitation status is therefore 'no public exploit identified at time of analysis.' The realistic risk is elevated-but-not-emergency: a patched, authenticated RCE in a self-hosted DDI/IPAM controller is attractive to attackers who have already gained a foothold or low-privilege credentials, but the PR:L requirement and absence of exploitation evidence make it targeted rather than mass-exploited. CWE is unspecified in the input (N/A), though the description clearly indicates an arbitrary file write (CWE-434/CWE-22 family) leading to code execution. Note: the fix version (6201) and vulnerability existence are vendor-confirmed by Zohocorp itself, which increases confidence in the technical claim even though independent exploitation data is absent. |
| Exploit ScenarioDerived | An attacker with low-privilege authenticated access to a DDI Central console abuses the HA Failover configuration-sync upload feature to write a malicious file to an attacker-controlled path on the server. Because the written file is executable in the application context, this yields remote code execution on the DDI/IPAM controller. No public exploit code is currently identified, and the low attack complexity (AC:L) means the write is reliable once authenticated access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.
RemediationAI
Vendor-released patch: upgrade to ManageEngine DDI Central build 6201 or later. The official advisory is available at https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html. If immediate patching is not possible, disable the High Availability failover configuration-sync feature if it is not operationally required, and restrict network access to the DDI Central management console to trusted administrative networks only-these measures reduce exposure but do not eliminate the flaw. Additionally, enforce least privilege by reviewing and minimizing accounts with access to the HA configuration upload functionality; note that disabling HA may impact redundancy and failover capabilities.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ManageEngine DDI Central is a DNS, DHCP, and IP address management (DDI) platform used to manage critical network infrastructure. The vulnerability exists in the High Availability (HA) failover configuration synchronization feature, specifically in the upload functionality that handles HA configuration files. An authenticated user with low privileges can abuse this upload endpoint to write arbitrary files to the server's filesystem, which can then be executed to achieve remote code execution. The root cause is a lack of proper validation on uploaded files-likely missing file-type restrictions, path sanitization, or destination controls-allowing an attacker to place executable content in a location where it can be triggered. The CPE string cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:* confirms the affected product is ZohoCorp's DDI Central, and the CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates the attack is remote, low-complexity, requires low-privilege authentication, and yields full compromise of confidentiality, integrity, and availability.
Know when Ddi Central gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HA sync upload with low-privilege auth (PR:L) and no user interaction; arbitrary file write to RCE gives full C/I/A on the host, scope unchanged.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
2DescriptionCVE.org
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.
Executive ViewAI
ManageEngine DDI Central, a platform many organizations rely on to run DNS, DHCP, and IP address management, contains a high-severity remote code execution flaw affecting deployments below build 6201, and no vendor-released patch has been identified at this time. A successful compromise would allow code execution on the server itself, threatening the confidentiality, integrity, and availability of the network services that depend on that instance. Leadership should care because DDI Central typically sits at the center of enterprise network operations, so a single exploited deployment could disrupt name resolution and address management across the business.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict network reachability of the High Availability failover configuration-sync endpoint to trusted HA peers only via firewall rules or network segmentation; disable or decommission the HA feature on instances where it is not operationally required; enforce least privilege and strong authentication on all DDI Central accounts; monitor the filesystem and application logs for unexpected file writes or configuration-sync anomalies; and isolate affected deployments until a vendor fix is available. Apply vendor patch as soon as one is released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
More in Ddi Central
View allAuthenticated operator-level users of Zoho ManageEngine DDI Central 6.2.0 (builds below 6201) can inject content into th
Authenticated low-privilege attackers can invoke destructive PostgreSQL database operations in Zoho ManageEngine DDI Cen
Exploit-DB