{"id":"CVE-2026-12266","kind":"vulnerability","aliases":["CVE-2026-12266"],"related":[],"title":"ManageEngine DDI Central 6.2.0 (build 6200): any logged-in user can read the LDAP bind password","description":"Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.","summary":"ManageEngine's advisory says DDI Central 6.2.0 build 6200 returned LDAP configuration, including the bind password, to authenticated users because the LDAP settings API lacked proper access control. Build 6201 enforces authorization and no longer returns LDAP credentials in API responses.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DDI Central","fixed":["build 6201"],"affected":"6.2.0 build 6200","ecosystem":"vendor"}],"ecosystems":[],"tags":["ddi-central","infrastructure","ldap","manageengine","self-hosted","windows"],"not_affected_if":["build-6201-or-later","no-ldap-integration"],"how_to_check":"- Check the installed DDI Central build (About page): build 6200 (6.2.0) is affected; build 6201 or later is fixed.\n- Check whether LDAP authentication is configured; if not, no bind password is stored to expose.\n- Review who holds DDI Central accounts: any authenticated user, not only admins, could retrieve the LDAP settings.","fix":"Update DDI Central Console and Node Agent instances to build 6201 using the service pack.","status":"open","published_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:39+00:00","updated_at":"2026-11-10T12:25:06+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-10T12:22:39Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"ManageEngine DDI Central: LDAP bind password exposed through settings API","impact":"medium","summary":"ManageEngine DDI Central versions 6200 and below expose the LDAP bind password through an insufficiently protected LDAP settings API. An attacker who can reach that API can read the service account credential used to query the directory.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["manageengine","ddi-central","ldap","windows"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"LDAP service account bind password readable by attacker","analyst_note":"Check the Zoho NVD entry and vendor advisory for the fixed version, required privilege on the LDAP settings API, and whether the API is reachable unauthenticated.","how_to_check":"- Confirm the installed DDI Central version under the product's about or version page; versions `6200` and below are affected.\n- Check whether the LDAP settings API endpoints are reachable from networks beyond administrators.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-ldap-integration"],"who_is_affected":"Organizations running ManageEngine DDI Central at version 6200 or below that have LDAP integration configured. Exposure depends on whether the LDAP settings API is reachable by users or networks that should not hold the bind credential. unknown whether any specific configuration is required beyond LDAP integration.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000726,"input_tokens":4520,"output_tokens":547,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Zoho NVD entry and vendor advisory for the fixed version, required privilege on the LDAP settings API, and whether the API is reachable unauthenticated.","search":"'-12266':20A,23A '-2026':19A,22A '6.2.0':4A,42B '6200':6A,44B,83C '6201':65B 'access':62B 'advisori':38B 'api':59B,75B,98C 'authent':53B 'author':67B 'bind':16A,50B,90C 'build':5A,43B,64B 'central':3A,25A,28B,41B,81C 'configur':47B 'control':63B 'corpor':78C 'credenti':73B 'cve':18A,21A 'ddi':2A,24A,27B,40B,80C 'ddi-centr':26B 'enforc':66B 'exposur':92C 'host':34B 'includ':48B 'infrastructur':29B 'insuffici':94C 'lack':60B 'ldap':15A,30B,46B,57B,72B,89C,96C 'log':9A 'logged-in':8A 'longer':70B 'manageengin':1A,31B,36B,79C 'password':17A,51B,91C 'proper':61B 'protect':95C 'read':13A 'respons':76B 'return':45B,71B 'say':39B 'self':33B 'self-host':32B 'set':58B,97C 'user':11A,54B 'version':82C 'vulner':87C 'window':35B 'zoho':77C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted ManageEngine DDI Central 6.2.0 build 6200 with LDAP authentication configured. Exploitation needs a valid DDI Central login (the vendor says authenticated users), and the exposed bind password gives access to the directory service account. Anyone on build 6201 or later, or without LDAP configured, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T12:25:06Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/readme.html","run_id":2449},"products":{"at":"2026-11-10T12:25:06Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/readme.html","run_id":2449},"how_to_check":{"at":"2026-11-10T12:25:06Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/readme.html","run_id":2449},"who_affected":{"at":"2026-11-10T12:25:06Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/readme.html","run_id":2449}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["central","ddicentral"],"ptokens":["central","ddi"],"labels":["ddicentral","high","infrastructure","ldap","manageengine","selfhosted","windows"],"campaign_type":null,"search_a":"'-12266':20A,23A '-2026':19A,22A '6.2.0':4A '6200':6A 'bind':16A 'build':5A 'central':3A,25A 'cve':18A,21A 'ddi':2A,24A 'ldap':15A 'log':9A 'logged-in':8A 'manageengin':1A 'password':17A 'read':13A 'user':11A","search_b":"'6.2.0':42B '6200':44B '6201':65B 'access':62B 'advisori':38B 'api':59B,75B 'authent':53B 'author':67B 'bind':50B 'build':43B,64B 'central':28B,41B 'configur':47B 'control':63B 'credenti':73B 'ddi':27B,40B 'ddi-centr':26B 'enforc':66B 'host':34B 'includ':48B 'infrastructur':29B 'lack':60B 'ldap':30B,46B,57B,72B 'longer':70B 'manageengin':31B,36B 'password':51B 'proper':61B 'respons':76B 'return':45B,71B 'say':39B 'self':33B 'self-host':32B 'set':58B 'user':54B 'window':35B","search_c":"'6200':83C 'api':98C 'bind':90C 'central':81C 'corpor':78C 'ddi':80C 'exposur':92C 'insuffici':94C 'ldap':89C,96C 'manageengin':79C 'password':91C 'protect':95C 'set':97C 'version':82C 'vulner':87C 'zoho':77C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12266","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12266","severity":null,"published_at":"2026-11-10T12:17:19+00:00","modified_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-12266:2449","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12266.html","severity":null,"published_at":"2026-11-10T12:25:06+00:00","modified_at":"2026-11-10T12:25:06+00:00","first_seen_at":"2026-11-10T12:25:06+00:00","fetched_at":"2026-11-10T12:25:06+00:00","note":"Vendor advisory: build 6200 affected, fixed in build 6201 (June 18, 2026); requires authenticated user, not unauthenticated. Not exploited per sources; no PoC seen. Did not search social.","cites":["https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12266.html","https://www.manageengine.com/dns-dhcp-ipam/readme.html"]}],"documents":[{"id":114951,"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12266.html","title":"ManageEngine DDI Central CVE-2026-12266","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114952,"url":"https://www.manageengine.com/dns-dhcp-ipam/readme.html","title":"DDI Central Read Me (build 6201)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}