DDI CENTRAL · CVE-2026-12266 · Infrastructure
FIX → build 6201 ✓ verified
ManageEngine's advisory says DDI Central 6.2.0 build 6200 returned LDAP configuration, including the bind password, to authenticated users because the LDAP settings API lacked proper access control. Build 6201 enforces authorization and no longer returns LDAP credentials in API responses.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running self-hosted ManageEngine DDI Central 6.2.0 build 6200 with LDAP authentication configured. Exploitation needs a valid DDI Central login (the vendor says authenticated users), and the exposed bind password gives access to the directory service account. Anyone on build 6201 or later, or without LDAP configured, can skip it.
Not affected if build-6201-or-later, no-ldap-integration
Who cares ddi-central, ldap, manageengine, self-hosted, windows
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to build 6201
Update DDI Central Console and Node Agent instances to build 6201 using the service pack.