CVE-2026-12572 · Vendor
NO FIX YET · SEE WHAT TO DO
ManageEngine DDI Central versions below 6201 let an attacker inject SQL through the username handling of HA replication. A successful injection gives command execution as the PostgreSQL service account.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
DDI Central installations below version 6201 that use HA replication are exposed, because the flaw is in how the replication username is handled. unknown whether a default configuration without HA replication is affected; the sources do not say. Teams on version 6201 or later can skip it.
Not affected if version-6201-or-later
Who cares ddi-central, manageengine, postgresql, self-hosted
62016201 or laterZoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.