EUVD-2026-56557
GHSA-fffc-2x8v-g95f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Password-reset auth bypass is network-reachable, unauthenticated, and needs no interaction (AV:N/AC:L/PR:N/UI:N); admin account takeover yields total C/I/A impact.
Primary rating from Vendor (0fc0942c-577d-436f-ae8e-945763c79b02).
CVSS VectorVendor: 0fc0942c-577d-436f-ae8e-945763c79b02
Lifecycle Timeline
3DescriptionCVE.org
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
AnalysisAI
Authentication bypass in Zoho ManageEngine DDI Central versions prior to 6201 lets remote unauthenticated attackers hijack the password-reset workflow to seize control of arbitrary accounts. Successful takeover of an administrative account grants full control over the DNS, DHCP, and IPAM management platform, with total impact to confidentiality, integrity, and availability. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires network reachability to the ManageEngine DDI Central web application and specifically its password-reset workflow, which must be enabled and accessible to the attacker; the flaw resides in that reset process, so an attacker interacts with the account-recovery feature rather than a normal login. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H = 9.8) indicates a low-complexity, network-reachable, unauthenticated attack requiring no user interaction - the maximum-severity profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: upgrade ManageEngine DDI Central to build 6201 or later, which is the first version outside the vulnerable range according to the EUVD data; the exact fixed build should be confirmed against the vendor bulletin at https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html before deployment. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, immediately isolate or restrict network access to all Zoho ManageEngine DDI Central instances to authorized administrators only using firewall or network controls, pending patch deployment. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today