CVE-2026-75869

Authenticated command injection

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-75868

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-75867

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-75864

Broken Access Control

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-19421

Authenticated Injection

Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-19422

Authentication Bypass

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.

CVSS 3.1 · 9.1 Critical EPSS n/a KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-12591

Privilege Escalation

Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit insufficient permission validation in the delegated administration interface to escalate privileges beyond their intended scope, which could result in remote code execution during administrative processing.

CVSS 3.1 · 9.9 Critical EPSS 1.7% KEV · Not listed

Vendors

Zohocorp

Products

M365 Manager Plus

CVE-2026-12507

Authenticated remote code execution

Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP versions below 15150, and SupportCenter Plus versions below 15150 are affected by a authenticated remote code execution vulnerability in the Reports module. An authenticated user with the Create Query Reports permission could exploit specially crafted database queries to execute arbitrary commands on the underlying server.

CVSS 3.1 · 9.1 Critical EPSS 9.4% KEV · Not listed

Vendors

Zohocorp

Products

Assetexplorer Servicedesk Plus Servicedesk Plus Msp and 1 more

CVE-2026-92905

Denial of Service (DoS)

Zoho Corporation ManageEngine EventLog Analyzer and Log360 versions below 13071 are vulnerable to a denial-of-service (DoS) vulnerability in the log collector component.

CVSS 3.1 · 5.3 Medium EPSS 1.0% KEV · Not listed

Vendors

Zohocorp

Products

Eventlog Analyzer Log360 Manageengine Eventlog Analyzer and 1 more

CVE-2026-12062

Authenticated SQL Injection

Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection vulnerability in ADAudit Plus Reports API.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Zohocorp

Products

Adaudit Plus

CVE-2026-76981

Authenticated Second-Order SQL Injection

Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL injection vulnerability affecting ADAudit Plus custom reports module.

CVSS 3.1 · 8.8 High EPSS 2.9% KEV · Not listed

Vendors

Zohocorp

Products

Adaudit Plus

CVE-2026-18912

Authenticated SQL injection

Zoho Corporation ManageEngine DataSecurity Plus versions below 6310 are vulnerable to an authenticated SQL injection vulnerability in reports module where an authenticated technician could execute arbitrary SQL queries.

CVSS 3.1 · 8.1 High EPSS 1.6% KEV · Not listed

Vendors

Zohocorp

Products

Datasecurity Plus Manageengine Datasecurity Plus

CVE-2026-12266

Authenticated Broken Access Control

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-12265

Authenticated Broken Access Control

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-12264

Authenticated Arbitrary File Write

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-12574

Server-Side HTML Injection

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-12573

Authenticated Command Injection

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.

CVSS 3.1 · 8.8 High EPSS 3.2% KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-12572

SQL Injection

Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.

CVSS 3.1 · 7.2 High EPSS 3.4% KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-95651

Authentication Bypass

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central

CVE-2026-95646

Authenticated Command Injection

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.

CVSS 3.1 · 8 High EPSS 3.9% KEV · Not listed

Vendors

Zohocorp

Products

Ddi Central