LDAP Bind Password Exposure Vulnerability in Zoho ManageEngine DDI Central
CVE-2026-12266

7.6HIGH

Key Information:

Vendor

Zohocorp
Status
Ddi Central
Vendor
CVE Published:
10 November 2026

What is CVE-2026-12266?

Zoho Corporation's ManageEngine DDI Central versions prior to 6201 present a significant security risk due to insufficiently protected LDAP settings API, allowing potential attackers to expose LDAP bind passwords. This vulnerability could lead to unauthorized access and compromise sensitive information, emphasizing the necessity for robust security measures in LDAP configurations.

Affected Version(s)

DDI Central 0 < 6201

References

https://www.manageengine.com/dns-dhcp-ipam/security-updat...

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.