Authorization Bypass in Zoho ManageEngine DDI Central Affects Non-Admin Users
CVE-2026-75867

8.1HIGH

Key Information:

Vendor

Zohocorp
Status
Ddi Central
Vendor
CVE Published:
12 November 2026

What is CVE-2026-75867?

An authorization bypass vulnerability exists in Zoho Corp's ManageEngine DDI Central, impacting versions prior to 6301. This flaw permits authenticated, non-administrative users to alter Windows DHCP filter-list configurations across clusters to which they should not have access. This vulnerability highlights significant security concerns, as it undermines intended access controls within the software, enabling unauthorized modifications that could jeopardize critical network infrastructure.

Affected Version(s)

DDI Central 0 < 6301

References

https://www.manageengine.com/dns-dhcp-ipam/security-updat...

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.