CVE-2026-12269: Authenticated File Write to RCE via keepalived in DDI Central
Zohocorp ManageEngine DDI Central 6.2.0 build below 6201 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.
Affected Software
Event History
Frequently Asked Questions
Which accounts can exploit this issue?
An authenticated operator-level user can exploit the vulnerable HA configuration workflow. The issue does not require user interaction and can be exploited over the network.
What level of access could successful exploitation provide?
An attacker may modify the Keepalived configuration and potentially execute commands as root on the DDI Central host. This could affect confidentiality, integrity, and availability.
Which deployments are affected?
The affected product is Zoho ManageEngine DDI Central 6.2.0 builds below 6201. The issue is specifically associated with the HA configuration workflow.