CVE-2026-19421 · Infrastructure
NO FIX YET · SEE WHAT TO DO
ManageEngine DDI Central versions below 6301 do not validate TXT record values before passing them to PowerShell during Windows DNS operations. An attacker who can supply a crafted TXT record value can inject PowerShell commands that run on the server.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organisations running ManageEngine DDI Central below version 6301 that use it to manage Windows DNS operations. The flaw is in handling of user-supplied TXT record values, so exposure depends on who can submit or influence those values. Deployments on fixed versions or without DDI Central can skip it.
Not affected if fixed-version, no-ddi-central
Who cares ddi-central, manageengine, windows, windows-dns
6301 are affected.6301 or later.Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.