SQL Injection Vulnerability in ManageEngine DDI Central by Zoho Corporation
CVE-2026-12572

7.2HIGH

Key Information:

Vendor

Zohocorp
Status
Ddi Central
Vendor
CVE Published:
10 November 2026

What is CVE-2026-12572?

ManageEngine DDI Central, developed by Zoho Corporation, has a security vulnerability that allows for SQL injection through improper handling of HA replication usernames. This flaw enables malicious actors to execute commands with the privileges of the PostgreSQL service account, potentially leading to unauthorized access and data manipulation. Users are advised to upgrade to version 6201 or later to mitigate this risk.

Affected Version(s)

DDI Central 0 < 6201

References

https://www.manageengine.com/dns-dhcp-ipam/security-updat...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.