What is the CVSS score of EUVD-2026-56557?

EUVD-2026-56557 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 1.6%.

Which versions of ManageEngine DDI Central are affected by EUVD-2026-56557?

A critical authentication bypass in Zoho ManageEngine DDI Central (versions prior to 6201) permits remote attackers to assume administrative control of DNS, DHCP, and IP management services without…. A patch is available.

How to fix or mitigate EUVD-2026-56557?

Within 24 hours, immediately isolate or restrict network access to all Zoho ManageEngine DDI Central instances to authorized administrators only using firewall or network controls, pending patch deployment. Within 7 days, deploy version 6201 or later across all affected instances and validate successful installation. Within 30 days, conduct a comprehensive audit of all DNS, DHCP, and IPAM configuration changes during the exposure window to detect and remediate any unauthorized modifications.

ManageEngine DDI Central EUVD-2026-56557

| CVE-2026-12571 CRITICAL

Improper Authentication (CWE-287)

2026-08-11 0fc0942c-577d-436f-ae8e-945763c79b02

GHSA-fffc-2x8v-g95f

Authentication Bypass Zoho

9.8

CVSS 3.1 · Vendor: 0fc0942c-577d-436f-ae8e-945763c79b02

Severity by source

Vendor (0fc0942c-577d-436f-ae8e-945763c79b02) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

9.8 CRITICAL

Password-reset auth bypass is network-reachable, unauthenticated, and needs no interaction (AV:N/AC:L/PR:N/UI:N); admin account takeover yields total C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (0fc0942c-577d-436f-ae8e-945763c79b02).

CVSS VectorVendor: 0fc0942c-577d-436f-ae8e-945763c79b02

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 21:26 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:17 cve.org

CRITICAL 9.8

DescriptionCVE.org

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

AnalysisAI

Authentication bypass in Zoho ManageEngine DDI Central versions prior to 6201 lets remote unauthenticated attackers hijack the password-reset workflow to seize control of arbitrary accounts. Successful takeover of an administrative account grants full control over the DNS, DHCP, and IPAM management platform, with total impact to confidentiality, integrity, and availability. There is no public exploit identified at time of analysis and it is not on CISA KEV, though CISA's SSVC framework rates the flaw as fully automatable with total technical impact.

Technical ContextAI

ManageEngine DDI Central is Zoho's centralized DDI (DNS, DHCP, IPAM) management platform used to administer network address infrastructure. The flaw is a CWE-287 (Improper Authentication) weakness located specifically in the password-reset workflow, meaning the logic that verifies a user's identity before allowing a credential change can be subverted. Because the reset process is the mechanism defenders rely on to recover accounts, a bypass here converts a routine self-service feature into a direct account-takeover primitive, likely by tampering with reset tokens, identity parameters, or workflow-state validation rather than exploiting a memory-safety bug.

RemediationAI

Patch available per vendor advisory: upgrade ManageEngine DDI Central to build 6201 or later, which is the first version outside the vulnerable range according to the EUVD data; the exact fixed build should be confirmed against the vendor bulletin at https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html before deployment. Until the upgrade is applied, restrict network access to the DDI Central web console so that the password-reset endpoint is reachable only from trusted management networks or via VPN (trade-off: legitimate remote admins lose direct access and must connect through the gateway), and closely monitor authentication and password-reset logs for anomalous reset requests or unexpected credential changes so takeover attempts can be detected and rolled back.