Command Injection Vulnerability in ManageEngine DDI Central for Windows DNS
CVE-2026-12267

7.2HIGH

Key Information:

Vendor

Zohocorp
Status
Ddi Central
Vendor
CVE Published:
28 September 2026

What is CVE-2026-12267?

ManageEngine DDI Central versions prior to 6201 are susceptible to a command injection vulnerability within the Windows DNS Query Resolution Policy name field. This flaw enables an attacker to execute arbitrary commands on the server, potentially leading to unauthorized access or manipulation of the system. Organizations using affected versions should prioritize updating to secure their environments against this significant risk.

Affected Version(s)

DDI Central 0 < 6201

References

https://www.manageengine.com/dns-dhcp-ipam/security-updat...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.