CVE-2026-19422

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-19422", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "Zohocorp", "dateReserved": "2026-08-10T10:54:36.168Z", "datePublished": "2026-11-12T12:16:50.068Z", "dateUpdated": "2026-11-12T12:16:50.068Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-11-12T12:16:50.068Z"}, "title": "Authentication Bypass", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 \u2013 Missing Authentication for Critical Function", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115 \u2013 Authentication Bypass"}]}], "affected": [{"vendor": "Zohocorp", "product": "DDI Central", "versions": [{"status": "affected", "version": "0", "lessThan": "6301", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "6301"}]}]}], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine\u00a0DDI Central\u00a0versions below\u00a06301\u00a0is affected by\u00a0an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>Zohocorp ManageEngine&nbsp;</span>DDI Central<span>&nbsp;versions below&nbsp;</span>6301<span>&nbsp;is affected by&nbsp;</span>an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications."}]}], "references": [{"url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "CRITICAL", "baseScore": 9.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "DDI Central", "vendor": "Zohocorp", "versions": [{"lessThan": "6301", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0fc0942c-577d-436f-ae8e-945763c79b02"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine\u00a0DDI Central\u00a0versions below\u00a06301\u00a0is affected by\u00a0an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications."}], "id": "CVE-2026-19422", "lastModified": "2026-11-12T19:02:35.830", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary"}]}, "published": "2026-11-12T13:17:16.347", "references": [{"source": "0fc0942c-577d-436f-ae8e-945763c79b02", "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html"}], "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "0fc0942c-577d-436f-ae8e-945763c79b02", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,6301)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "DDI Central", "source": "cna", "vendor": "Zohocorp"}, "product": "ddi_central", "vendor": "zohocorp"}], "created": "2026-11-13T04:15:14.472604+00:00", "updated": "2026-11-13T04:15:14.472620+00:00", "vendors": ["zohocorp", "zohocorp$PRODUCT$ddi_central"]}