{"id":"CVE-2026-12572","kind":"vulnerability","aliases":["CVE-2026-12572"],"related":[],"title":"ManageEngine DDI Central: SQL injection in HA replication leads to command execution","description":"Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.","summary":"ManageEngine DDI Central versions below 6201 let an attacker inject SQL through the username handling of HA replication. A successful injection gives command execution as the PostgreSQL service account.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ddi-central","manageengine","postgresql","self-hosted","vendor"],"not_affected_if":["version-6201-or-later"],"how_to_check":"- Check the installed DDI Central version and confirm whether it is below `6201`\n- Check whether high availability (HA) replication is configured on the appliance","fix":"- Move DDI Central to version `6201` or later","status":"open","published_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","triaged_at":"2026-11-10T12:22:37+00:00","updated_at":"2026-11-10T12:22:37+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T12:22:37Z","model":"claude-haiku-5-5","output":{"fix":"- Move DDI Central to version `6201` or later","reach":"network","title":"ManageEngine DDI Central: SQL injection in HA replication leads to command execution","impact":"high","summary":"ManageEngine DDI Central versions below 6201 let an attacker inject SQL through the username handling of HA replication. A successful injection gives command execution as the PostgreSQL service account.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","ddi-central","postgresql","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker runs commands as the PostgreSQL service account","analyst_note":"Confirm whether HA replication must be enabled and whether authentication is required, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-12572 and the vendor advisory.","how_to_check":"- Check the installed DDI Central version and confirm whether it is below `6201`\n- Check whether high availability (HA) replication is configured on the appliance","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["version-6201-or-later"],"who_is_affected":"DDI Central installations below version 6201 that use HA replication are exposed, because the flaw is in how the replication username is handled. unknown whether a default configuration without HA replication is affected; the sources do not say. Teams on version 6201 or later can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000728,"input_tokens":4521,"output_tokens":552,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-12572':15A,18A '-2026':14A,17A '6201':33B,64C 'account':56B,83C 'attack':36B 'central':3A,21B,30B,61C 'command':11A,50B,77C 'corpor':58C 'cve':13A,16A 'ddi':2A,20B,29B,60C 'ddi-centr':19B 'execut':12A,51B,78C 'give':49B 'ha':7A,44B,71C 'handl':42B,74C 'host':26B 'inject':5A,37B,48B,69C 'lead':9A,75C 'let':34B 'manageengin':1A,22B,28B,59C 'postgresql':23B,54B,81C 'replic':8A,45B,72C 'self':25B 'self-host':24B 'servic':55B,82C 'sql':4A,38B,68C 'success':47B 'usernam':41B,73C 'vendor':27B 'version':31B,62C 'vulner':66C 'zoho':57C","nicknames":[],"mitigations":[],"who_affected":"DDI Central installations below version 6201 that use HA replication are exposed, because the flaw is in how the replication username is handled. unknown whether a default configuration without HA replication is affected; the sources do not say. Teams on version 6201 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ddicentral","high","manageengine","postgresql","selfhosted","vendor"],"campaign_type":null,"search_a":"'-12572':15A,18A '-2026':14A,17A 'central':3A 'command':11A 'cve':13A,16A 'ddi':2A 'execut':12A 'ha':7A 'inject':5A 'lead':9A 'manageengin':1A 'replic':8A 'sql':4A","search_b":"'6201':33B 'account':56B 'attack':36B 'central':21B,30B 'command':50B 'ddi':20B,29B 'ddi-centr':19B 'execut':51B 'give':49B 'ha':44B 'handl':42B 'host':26B 'inject':37B,48B 'let':34B 'manageengin':22B,28B 'postgresql':23B,54B 'replic':45B 'self':25B 'self-host':24B 'servic':55B 'sql':38B 'success':47B 'usernam':41B 'vendor':27B 'version':31B","search_c":"'6201':64C 'account':83C 'central':61C 'command':77C 'corpor':58C 'ddi':60C 'execut':78C 'ha':71C 'handl':74C 'inject':69C 'lead':75C 'manageengin':59C 'postgresql':81C 'replic':72C 'servic':82C 'sql':68C 'usernam':73C 'version':62C 'vulner':66C 'zoho':57C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T12:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-12572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-12572","severity":null,"published_at":"2026-11-10T12:17:19+00:00","modified_at":"2026-11-10T12:17:19+00:00","first_seen_at":"2026-11-10T12:21:54+00:00","fetched_at":"2026-11-10T12:21:54+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}