CVE-2026-12265: Authenticated Broken Access Control
Published Sep 28, 2026
·Updated
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
Affected Software
1 affected component
Zoho ManageEngine DDI Central<=6200
Event History
Sep 28, 2026
CVE Published
via MITRE·12:22 PM
Data Sourced
via MITRE·12:22 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·01:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
Zohocorp ManageEngine DDI Central versions before 6201 are affected. Version 6201 and later are not identified as affected by the provided information.
2
What access does an attacker need to exploit this issue?
The vector is network-accessible and requires low privileges. No user interaction is required, according to the supplied CVSS vector.
3
What could exploitation allow?
The vulnerable HA failover endpoint can permit destructive PostgreSQL database operations. The reported impact includes complete compromise of confidentiality, integrity, and availability.