CVE-2026-12264: Authenticated Arbitrary File Write
Published Sep 28, 2026
·Updated
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to arbitrary file write via HA Failover Config sync upload leading to code execution as root.
Affected Software
1 affected component
Zoho ManageEngine DDI Central<=6200
Event History
Sep 28, 2026
CVE Published
via MITRE·11:51 AM
Data Sourced
via MITRE·11:51 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What level of access does an attacker need to exploit this issue?
An attacker needs authenticated access with low privileges. No user interaction is required, and the attack can be performed over the network.
2
Which deployments are affected?
Zohocorp ManageEngine DDI Central versions earlier than 6201 are affected. The issue is in the HA Failover Config sync upload functionality.
3
What is the potential impact of successful exploitation?
Successful exploitation can allow arbitrary file writes and lead to remote code execution. The reported impact includes compromise of confidentiality, integrity, and availability.