CVE-2026-75868: Broken Access Control
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Zohocorp ManageEngine DDI Centralto a version that resolves this vulnerability.Fixed in 6301
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated non-administrative user can exploit it. The affected action is modifying DHCP options on subnets in clusters the user is not authorized to manage.
What versions are affected?
ManageEngine DDI Central versions below 6301 are affected.
Is patching required to prevent exploitation?
The provided information identifies versions below 6301 as affected, but does not describe a workaround or mitigation for environments that cannot patch immediately.