ManageEngine DDI Central EUVD-2026-88213

Requires an authenticated low-privileged account on ManageEngine DDI Central (version below 6201) with the ability to create or modify DNS SPF/TXT records, and the deployment must be configured to push those records to a managed Windows DNS server - the PowerShell-based push integration is the injection sink. Limiting factors: valid credentials are needed (PR:L, no unauthenticated path), the Windows DNS integration must be active, and installations already upgraded to 6201 or later are not affected. No user interaction is required once the malicious record is pushed.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, yielding full confidentiality, integrity, and availability compromise - consistent with command injection leading to RCE. I concur with this vector. However, the real-world urgency signals are weak-to-absent: there is no EPSS score provided, no CISA KEV listing, and no public proof-of-concept referenced, so this is 'no public exploit identified at time of analysis.' The only reference is the vendor's own security-updates page, meaning a fix exists (version 6201) but no independent exploitation intelligence corroborates active abuse. Net: a genuinely high-severity, patch-worthy RCE, but currently a priority driven by severity and product exposure rather than by evidence of exploitation. Note the PR:L requirement - an attacker must first hold a valid low-privilege account in DDI Central, which meaningfully limits opportunistic mass exploitation compared with an unauthenticated flaw.

An attacker with a low-privileged authenticated account in ManageEngine DDI Central (version below 6201) submits a crafted DNS SPF/TXT record value containing embedded PowerShell metacharacters. When DDI Central pushes that record to a managed Windows DNS server, the malicious input is interpolated into a PowerShell command and executed, giving the attacker remote code execution on the host. No public proof-of-concept is currently identified, and exploitation requires valid credentials.