CVE-2026-75869: Authenticated command injection

Published Nov 12, 2026

Updated

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Zohocorp ManageEngine DDI Central to a version that resolves this vulnerability.
Fixed in 6301

Event History

Nov 12, 2026

CVE Published

via MITRE·12:40 PM

Data Sourced

via MITRE·12:40 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·01:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Authenticated non-administrative users can exploit it. The flaw lets them target Windows DHCP subnets they are not authorized to manage.

What systems are at risk of command execution?

Managed Windows DHCP servers are the potential command-execution targets. Exploitation involves crafted DNS suffix values and may allow arbitrary commands to run on those servers.

Which product versions are affected?

ManageEngine DDI Central versions below 6301 are affected.