EUVD-2026-88237
GHSA-9c8c-6fxg-mppr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege DDI Central account
-
DeliveryReach HA failover endpoint over network
-
ExploitAbuse insufficient access control check
-
ExecutionTrigger destructive PostgreSQL operations
-
ImpactCorrupt/destroy IPAM database and disrupt service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires a valid low-privilege authenticated account on ManageEngine DDI Central (PR:L) with network reachability to the application; no user interaction is needed. The specific prerequisite is access to the HA (high-availability) failover endpoint, whose access-control check is insufficient, allowing a low-priv actor to invoke destructive PostgreSQL operations they should not be able to. Limiting factors: an attacker must first obtain credentials for the DDI Central instance, and the target must be running a version before 6201; exploitation is not possible fully unauthenticated. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 8.8) describes a low-complexity, network-reachable flaw requiring only low-privilege authentication and no user interaction, with full impact across confidentiality, integrity, and availability. The high I:H/A:H rating is consistent with the description's 'destructive PostgreSQL database operations,' which threaten data integrity and service availability; C:H is plausible since database access can also expose stored records. This is a genuine priority for any organization running DDI Central, because an authenticated low-privilege user (any valid account, potentially a limited operator) can abuse the HA failover endpoint. However, several exploitation signals are absent: no EPSS score, no CISA KEV listing, and no public POC are provided, so there is no evidence of active or automated exploitation - the risk is currently theoretical/latent rather than demonstrated. No SSVC decision data was supplied. Note a metadata conflict: the input tags this as 'Information Disclosure,' but the description and I:H/A:H metrics indicate a destructive integrity/availability issue, not primarily disclosure - verify impact framing against the vendor advisory. |
| Exploit ScenarioDerived | An attacker holding a low-privilege authenticated account on ManageEngine DDI Central sends a crafted request to the HA failover endpoint, which fails to enforce proper access control. This lets the attacker trigger destructive PostgreSQL operations - corrupting or dropping backend data - disrupting DNS/DHCP/IPAM services. No public exploit code is identified at time of analysis, and the network vector with low complexity makes exploitation straightforward once credentials are obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 28, 2026
Authenticated low-privilege attackers can invoke destructive PostgreSQL database operations in Zoho ManageEngine DDI Central by exploiting insufficient access control on the high-availability (HA) failover endpoint in all versions before 6201. With a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is network-reachable, requires only low-privilege credentials and no user interaction, and carries full impact to confidentiality, integrity, and availability - an attacker who reaches the failover endpoint can act well beyond their intended permissions. The vendor has published a fix in version 6201, and no public exploit code has been identified at time of analysis; this CVE is not in CISA KEV, so there is no confirmation of active exploitation.
RemediationAI
Apply the vendor fix by upgrading ManageEngine DDI Central to version 6201 or later, on every node in the HA cluster, and consult the ManageEngine DNS-DHCP-IPAM security advisory at https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html for build-specific guidance - this is a vendor-released patch: 6201. If immediate upgrade is not feasible, restrict network access to the DDI Central management interface and, in particular, the HA failover endpoint, so that only trusted administrative networks or jump hosts can reach it; the trade-off is that legitimate failover and cluster administration traffic must be re-routed through those approved paths, and overly broad filtering can interfere with automatic failover. Additional compensating controls include auditing and rotating credentials for all DDI Central accounts so that low-privilege sessions cannot be obtained by unmanaged users, enabling detailed logging and alerting on requests to the failover endpoint and on unexpected PostgreSQL schema or data changes, and ensuring tested offline or point-in-time backups of the PostgreSQL backend exist so destructive operations can be recovered from. Because the flaw requires a valid low-privilege account (PR:L) and network reachability, tightening authentication sources and enforcing least-privilege role assignment reduces exploitability while the patch is staged; none of these compensating controls removes the underlying access-control defect, so upgrade remains the definitive fix.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ManageEngine DDI Central is Zoho's DNS, DHCP, and IP address management (DDI) platform, identified in the affected CPE as cpe:2.3:a:zohocorp:ddi_central with a wildcard version range covering everything prior to 6201. The component at issue is the high-availability failover endpoint, a management interface that coordinates state between DDI Central nodes and therefore holds elevated privileges over the underlying PostgreSQL datastore that backs the product. The reported root cause is insufficient access control - the authorization class consistent with CWE-284 (Improper Access Control) or CWE-862 (Missing Authorization), although no CWE identifier was assigned in the source data - meaning the failover endpoint's permission check does not adequately distinguish a low-privilege principal from an administrative one, nor adequately constrain which database operations can be requested through it. Because the endpoint legitimately performs failover-driven database operations, an attacker who can call it with a valid low-privilege session can reach PostgreSQL actions that should be reserved for HA orchestration, giving a path from a routine account to destructive database manipulation. The presence of the PostgreSQL tag in the intelligence feed reinforces that the impact surface is the relational backend rather than the web tier alone.
Know when Ddi Central gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable HA endpoint exploitable by any low-privilege authenticated user (PR:L) with no interaction; destructive DB operations yield full integrity and availability loss, with confidentiality exposure from database access.
Primary rating from Vendor (Zohocorp).
CVSS VectorVendor: Zohocorp
Lifecycle Timeline
2DescriptionCVE.org
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
Executive ViewAI
Zoho ManageEngine DDI Central, which organizations rely on for DNS, DHCP, and IP address management, contains an access-control weakness in its high-availability failover endpoint that lets any attacker holding basic low-privilege credentials execute destructive PostgreSQL operations. Because the failover service is network-reachable and requires no user interaction, a single compromised or misused account can corrupt, expose, or wipe the very database records that underpin network addressing - a failure mode that can take dependent business services offline. Leadership should treat this as a high-priority platform-integrity issue affecting any environment running versions earlier than 6201, and note there is no confirmation of active exploitation at this time.
Vendor-released patch: 6201. Until it is applied, restrict network access to the HA failover endpoint to trusted HA peers, enforce least privilege and rotate credentials for all low-privilege accounts, and monitor for anomalous PostgreSQL operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Ddi Central
View allAuthenticated operator-level users of Zoho ManageEngine DDI Central 6.2.0 (builds below 6201) can inject content into th
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before b
Exploit-DB