CVE-2026-19421: Authenticated Injection
Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zohocorp ManageEngine DDI Centralto a version that resolves this vulnerability.Fixed in 6301
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs authenticated access with the ability to supply TXT record values used in Windows DNS operations. The vulnerability is remotely reachable and does not require user interaction.
Which deployments are affected?
ManageEngine DDI Central versions below 6301 are affected. The provided information does not state whether any particular default role or configuration exposes the vulnerable functionality.
What is the likely impact of successful exploitation?
Successful exploitation can result in high-impact compromise of confidentiality, integrity, and availability, as reflected by the CVSS vector. The issue is an OS command injection through insufficient validation of TXT record values.