---
id: "CVE-2026-12266"
page: "https://infrastack.ai/live/CVE-2026-12266"
kind: "vulnerability"
aliases: ["CVE-2026-12266"]
title: "ManageEngine DDI Central 6.2.0 (build 6200): any logged-in user can read the LDAP bind password"
severity: "high"
cvss: 7.6
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "DDI Central", "fixed": ["build 6201"], "affected": "6.2.0 build 6200", "ecosystem": "vendor"}]
ecosystems: []
tags: ["ddi-central", "infrastructure", "ldap", "manageengine", "self-hosted", "windows"]
not_affected_if: ["build-6201-or-later", "no-ldap-integration"]
published_at: "2026-11-10T12:17:19+00:00"
first_seen_at: "2026-11-10T12:21:54+00:00"
updated_at: "2026-11-10T12:25:06+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12266", "first_seen_at": "2026-11-10T12:21:54+00:00"}, {"source": "analyst", "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12266.html", "first_seen_at": "2026-11-10T12:25:06+00:00", "cites": ["https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12266.html", "https://www.manageengine.com/dns-dhcp-ipam/readme.html"]}]
exploit_sources: []
---

# ManageEngine DDI Central 6.2.0 (build 6200): any logged-in user can read the LDAP bind password

Link for people: https://infrastack.ai/live/CVE-2026-12266 (this .md is for agents)

ManageEngine's advisory says DDI Central 6.2.0 build 6200 returned LDAP configuration, including the bind password, to authenticated users because the LDAP settings API lacked proper access control. Build 6201 enforces authorization and no longer returns LDAP credentials in API responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DDI Central affected 6.2.0 build 6200 fixed build 6201

## How to check

- Check the installed DDI Central build (About page): build 6200 (6.2.0) is affected; build 6201 or later is fixed.
- Check whether LDAP authentication is configured; if not, no bind password is stored to expose.
- Review who holds DDI Central accounts: any authenticated user, not only admins, could retrieve the LDAP settings.

## Fix

Update DDI Central Console and Node Agent instances to build 6201 using the service pack.

## Timeline

- 2026-11-10T12:21:54+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-12266
- 2026-11-10T12:25:06+00:00 analyst https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12266.html — Vendor advisory: build 6200 affected, fixed in build 6201 (June 18, 2026); requires authenticated user, not unauthenticated. Not exploited per sources; no PoC seen. Did not search social.

## Documents

- [advisory] ManageEngine DDI Central CVE-2026-12266 https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-12266.html
- [fix] DDI Central Read Me (build 6201) https://www.manageengine.com/dns-dhcp-ipam/readme.html

## From the sources

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_