CVE-2026-12269
HighCVSS 8.8Summary
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
Risk Assessment
An authenticated operator could escalate privileges to root and execute arbitrary commands, potentially leading to full system compromise. This may result in breaches of confidentiality, integrity, and availability of managed resources.
Recommendation
Update ManageEngine DDI Central to version 6201 or later, which fixes this vulnerability. Until updated, restrict operator privileges and monitor for unusual changes in HA configuration.
Other vulnerabilities in ManageEngine DDI Central
See all- CVE-2026-12268High
ManageEngine DDI Central versions below 6201 are vulnerable to PowerShell command injection in Windows DNS SPF/TXT record push leading to remote code execution. The vulnerability occurs during the processing of DNS records.
- CVE-2026-12267High
ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution. The vulnerability occurs in the context of DNS query resolution.
- CVE-2026-12571Critical
An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
Original NVD description (English source)
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS