ManageEngine DDI Central CVE-2026-12269

Requires an authenticated operator-level account on ManageEngine DDI Central 6.2.0 (build below 6201) and access to the High Availability (HA) configuration workflow. The attacker must be able to reach and modify the Keepalived configuration; exploitation depends on the HA/Keepalived feature being present and configurable, and Keepalived running as root (which enables the privilege escalation to command execution). The primary limiting factor is the PR:L authentication requirement - a valid operator credential is mandatory; no user interaction is needed and the attack is over the network against the management interface.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) reflects a genuinely serious flaw: a network-reachable, low-complexity path from operator-level authentication to root-level command execution on the DDI Central host, with full confidentiality, integrity, and availability impact. However, the raw score should be read against tempering signals. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active or automated exploitation - exploitation status is 'no public exploit identified at time of analysis.' The vulnerability was reported by the vendor (Zohocorp) itself and shipped with a fix (build 6201), which is typical of coordinated disclosure rather than in-the-wild discovery. The most important real-world limiter is PR:L: the attacker must already hold an authenticated operator-level account on the DDI Central management interface, which substantially narrows the population of realistic attackers to insiders or those who have already obtained valid operator credentials. Net: a real priority to patch for organizations running the affected build because the outcome is root RCE, but not an emergency-grade internet-wide threat given the authentication requirement and absence of exploitation signals. Note also a CWE/tag mismatch - see confidence_notes and data_quality_flags: the flaw is described as configuration injection (into Keepalived) leading to command execution, not a classic file upload, yet it carries CWE-434 and a 'File Upload' tag.

An attacker with operator-level credentials to ManageEngine DDI Central 6.2.0 (build < 6201) navigates to the High Availability (HA) configuration workflow and injects malicious directives into the Keepalived configuration. Because Keepalived runs with root privileges and executes configured scripts/notify hooks, the injected content is executed as root on the host. No public exploit code is identified, but the low attack complexity and authenticated-web vector make weaponization straightforward for anyone holding an operator account.