Ddi Central
Monthly
Authenticated low-privilege attackers can invoke destructive PostgreSQL database operations in Zoho ManageEngine DDI Central by exploiting insufficient access control on the high-availability (HA) failover endpoint in all versions before 6201. With a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is network-reachable, requires only low-privilege credentials and no user interaction, and carries full impact to confidentiality, integrity, and availability - an attacker who reaches the failover endpoint can act well beyond their intended permissions. The vendor has published a fix in version 6201, and no public exploit code has been identified at time of analysis; this CVE is not in CISA KEV, so there is no confirmation of active exploitation.
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.
Authenticated operator-level users of Zoho ManageEngine DDI Central 6.2.0 (builds below 6201) can inject content into the Keepalived configuration through the High Availability (HA) configuration workflow, which under the right conditions escalates to arbitrary command execution as root on the DDI Central host. The flaw is network-reachable and low in complexity (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), but it is gated by a mandatory valid operator credential and by the HA/Keepalived feature being present and configurable, so it is not pre-authentication and not self-propagating. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor has published a security advisory at https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12269.html.
Authenticated low-privilege attackers can invoke destructive PostgreSQL database operations in Zoho ManageEngine DDI Central by exploiting insufficient access control on the high-availability (HA) failover endpoint in all versions before 6201. With a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the flaw is network-reachable, requires only low-privilege credentials and no user interaction, and carries full impact to confidentiality, integrity, and availability - an attacker who reaches the failover endpoint can act well beyond their intended permissions. The vendor has published a fix in version 6201, and no public exploit code has been identified at time of analysis; this CVE is not in CISA KEV, so there is no confirmation of active exploitation.
Authenticated low-privilege attackers can achieve remote code execution on ManageEngine DDI Central deployments before build 6201 by uploading arbitrary files through the High Availability failover configuration-sync endpoint, which writes attacker-controlled content to the filesystem and enables code execution. The flaw is network-reachable with low complexity and no user interaction, but requires valid credentials and that the HA feature be reachable; no public exploit code or active exploitation is currently confirmed. With a CVSS base score of 8.8, the issue carries high confidentiality, integrity, and availability impact for affected infrastructure-management instances.
Authenticated operator-level users of Zoho ManageEngine DDI Central 6.2.0 (builds below 6201) can inject content into the Keepalived configuration through the High Availability (HA) configuration workflow, which under the right conditions escalates to arbitrary command execution as root on the DDI Central host. The flaw is network-reachable and low in complexity (CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8), but it is gated by a mandatory valid operator credential and by the HA/Keepalived feature being present and configurable, so it is not pre-authentication and not self-propagating. No public exploit code or confirmed in-the-wild exploitation has been identified at time of analysis, and the vendor has published a security advisory at https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12269.html.