ManageEngine DDI Central CVE-2026-12267

Requires authenticated high-privilege access to the ManageEngine DDI Central management console (PR:H) with the ability to create or edit a Windows DNS Query Resolution Policy; exploitation is performed by embedding command metacharacters in that policy's name field. The affected deployment must be a DDI Central instance running a version below 6201 that manages Windows DNS. Limiting factors: administrative authentication is mandatory, no user interaction beyond the attacker's own actions is needed (UI:N), and the injection is reachable over the network (AV:N) but only through the privileged policy-configuration workflow rather than any default/anonymous endpoint.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H = 7.2 HIGH) describes a network-reachable, low-complexity command injection that nevertheless requires high privileges (PR:H) - i.e. an already-authenticated administrator of the DDI Central console who can define/edit a Windows DNS Query Resolution Policy. This is the single most important limiting factor: the flaw is a privileged-operator RCE, not an unauthenticated internet-facing break-in, which substantially lowers real-world urgency. No EPSS score, no CISA KEV listing, and no public POC were supplied, so exploitation is best characterized as no public exploit identified at time of analysis. There is no SSVC decision data provided. The net picture is a genuine RCE (full C/I/A on the host) gated behind admin authentication - a real but not top-tier priority, most relevant as a privilege-consolidation / post-compromise or malicious-insider vector rather than mass exploitation. Note the CWE is listed as CWE-20 (improper input validation) while the description and tags describe OS command injection (more precisely CWE-78) - the classification is loose but consistent with the RCE outcome.

An authenticated administrator (or an attacker who has captured admin credentials/session) of ManageEngine DDI Central opens the Windows DNS Query Resolution Policy configuration and supplies a policy name containing shell/command metacharacters; the unvalidated field is passed to an OS command, executing attacker-chosen code on the DDI Central server. No public exploit code was identified, and success requires the high-privilege console access reflected by PR:H.