CVE-2026-12265
HighCVSS 8.8Exploitation Probability (EPSS)
Elevated risk58th percentile - higher than 58% of all known CVEs
Summary
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to insufficient access control in the HA failover endpoint. This allows destructive PostgreSQL database operations.
Risk Assessment
An attacker could trigger destructive operations on the PostgreSQL database, potentially leading to loss or corruption of critical service data.
Recommendation
Update ManageEngine DDI Central to version 6201 or later to eliminate the access control flaw.
Other vulnerabilities in ManageEngine DDI Central
See all- CVE-2026-12269High
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
- CVE-2026-12268High
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution. The vulnerability occurs during the processing of DNS records.
- CVE-2026-12571Critical
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
- CVE-2026-12264High
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to arbitrary file write via HA Failover Config sync upload, leading to remote code execution.
- CVE-2026-12267High
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution. The vulnerability occurs in the context of DNS query resolution.
Original NVD description (English source)
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS