CVE-2026-75867: Broken Access Control
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zohocorp ManageEngine DDI Centralto a version that resolves this vulnerability.Fixed in 6301
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated non-administrative user may be able to exploit the authorization bypass. No administrator privileges or user interaction are required.
What systems and configurations are affected?
ManageEngine DDI Central versions below 6301 are affected. The issue allows modification of Windows DHCP filter-list configurations on clusters the user is not authorized to manage.
What is the remediation?
Upgrade ManageEngine DDI Central to version 6301 or later. The provided information does not identify a workaround for deployments that cannot be upgraded immediately.