CVE-2026-12572: SQL Injection
Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zoho Corporation ManageEngine DDI Centralto a version that resolves this vulnerability.Fixed in 6201
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs high privileges in ManageEngine DDI Central and network access. The vulnerable input is the HA replication username handling.
What is the impact of successful exploitation?
Successful SQL injection can lead to command execution as the PostgreSQL service account, with high confidentiality, integrity, and availability impact.
Which installations are affected?
ManageEngine DDI Central versions below 6201 are affected. The provided information does not state whether HA replication is enabled by default.