CVE-2026-75864: Broken Access Control

Published Nov 12, 2026

Updated

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Zohocorp ManageEngine DDI Central to a version that resolves this vulnerability.
Fixed in 6301

Event History

Nov 12, 2026

CVE Published

via MITRE·12:21 PM

Data Sourced

via MITRE·12:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated non-administrative user can exploit it. The flaw allows deletion of DNS zones outside that user's assigned scope.

Which deployments are affected?

ManageEngine DDI Central versions below 6301 are affected. The provided information does not state whether any particular default configuration changes exposure.

What is the impact of successful exploitation?

An attacker can delete DNS zones they are not authorized to manage, which can disrupt DNS availability and alter DNS configuration integrity.