CVE-2026-12266: Authenticated Broken Access Control
Published Nov 10, 2026
·Updated
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.
Affected Software
1 affected component
Zoho ManageEngine DDI Central<=6200
Event History
Nov 10, 2026
CVE Published
via MITRE·11:44 AM
Data Sourced
via MITRE·11:44 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·12:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The vulnerability is authenticated and requires low-level privileges. An attacker must be able to access the LDAP settings API.
2
What information could be exposed?
LDAP bind passwords may be exposed through the insufficiently protected LDAP settings API. The available data does not specify whether other LDAP configuration details are exposed.
3
Which deployments are affected?
ManageEngine DDI Central versions 6200 and below are affected. The available information does not state whether LDAP must be configured or enabled for exposure to occur.