{"id":"CVE-2026-19421","kind":"vulnerability","aliases":["CVE-2026-19421"],"related":[],"title":"ManageEngine DDI Central: PowerShell injection via DNS TXT record values","description":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.","summary":"ManageEngine DDI Central versions below 6301 do not validate TXT record values before passing them to PowerShell during Windows DNS operations. An attacker who can supply a crafted TXT record value can inject PowerShell commands that run on the server.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ddi-central","infrastructure","manageengine","windows","windows-dns"],"not_affected_if":["fixed-version","no-ddi-central"],"how_to_check":"- Check the installed DDI Central version in the product's about page or install directory; versions below `6301` are affected.\n- Confirm whether DDI Central manages Windows DNS zones in your environment.","fix":"- ManageEngine DDI Central: upgrade to `6301` or later.","status":"open","published_at":"2026-11-12T12:18:24+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","triaged_at":"2026-11-12T12:40:27+00:00","updated_at":"2026-11-12T12:40:27+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-11-12T12:40:27Z","model":"claude-haiku-5-5","output":{"fix":"- ManageEngine DDI Central: upgrade to `6301` or later.","reach":"unknown","title":"ManageEngine DDI Central: PowerShell injection via DNS TXT record values","impact":"high","summary":"ManageEngine DDI Central versions below 6301 do not validate TXT record values before passing them to PowerShell during Windows DNS operations. An attacker who can supply a crafted TXT record value can inject PowerShell commands that run on the server.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["manageengine","ddi-central","windows-dns","windows"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Commands run as the service account on the DDI server","analyst_note":"Check the Zoho/ManageEngine advisory for required privileges, reachability and exploitation status; NVD description alone does not state auth or reach.","how_to_check":"- Check the installed DDI Central version in the product's about page or install directory; versions below `6301` are affected.\n- Confirm whether DDI Central manages Windows DNS zones in your environment.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["fixed-version","no-ddi-central"],"who_is_affected":"Organisations running ManageEngine DDI Central below version 6301 that use it to manage Windows DNS operations. The flaw is in handling of user-supplied TXT record values, so exposure depends on who can submit or influence those values. Deployments on fixed versions or without DDI Central can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000749,"input_tokens":4529,"output_tokens":592,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-19421':13A,16A '-2026':12A,15A '6301':31B,72C 'affect':74C 'attack':48B 'central':3A,19B,28B,69C 'command':60B 'craft':53B 'cve':11A,14A 'ddi':2A,18B,27B,68C 'ddi-centr':17B 'dns':7A,25B,45B,93C 'due':80C 'infrastructur':20B 'inject':5A,58B,78C 'insuffici':82C 'manageengin':1A,21B,26B,67C 'oper':46B,94C 'pass':39B 'powershel':4A,42B,59B,77C 'record':9A,36B,55B,89C 'run':62B 'server':65B 'suppli':51B,87C 'txt':8A,35B,54B,88C 'user':86C 'user-suppli':85C 'valid':34B,83C 'valu':10A,37B,56B,90C 'version':29B,70C 'via':6A 'vulner':79C 'window':22B,24B,44B,92C 'windows-dn':23B 'zohocorp':66C","nicknames":[],"mitigations":[],"who_affected":"Organisations running ManageEngine DDI Central below version 6301 that use it to manage Windows DNS operations. The flaw is in handling of user-supplied TXT record values, so exposure depends on who can submit or influence those values. Deployments on fixed versions or without DDI Central can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ddicentral","high","infrastructure","manageengine","windows","windowsdns"],"campaign_type":null,"search_a":"'-19421':13A,16A '-2026':12A,15A 'central':3A 'cve':11A,14A 'ddi':2A 'dns':7A 'inject':5A 'manageengin':1A 'powershel':4A 'record':9A 'txt':8A 'valu':10A 'via':6A","search_b":"'6301':31B 'attack':48B 'central':19B,28B 'command':60B 'craft':53B 'ddi':18B,27B 'ddi-centr':17B 'dns':25B,45B 'infrastructur':20B 'inject':58B 'manageengin':21B,26B 'oper':46B 'pass':39B 'powershel':42B,59B 'record':36B,55B 'run':62B 'server':65B 'suppli':51B 'txt':35B,54B 'valid':34B 'valu':37B,56B 'version':29B 'window':22B,24B,44B 'windows-dn':23B","search_c":"'6301':72C 'affect':74C 'central':69C 'ddi':68C 'dns':93C 'due':80C 'inject':78C 'insuffici':82C 'manageengin':67C 'oper':94C 'powershel':77C 'record':89C 'suppli':87C 'txt':88C 'user':86C 'user-suppli':85C 'valid':83C 'valu':90C 'version':70C 'vulner':79C 'window':92C 'zohocorp':66C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T12:18:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19421","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19421","severity":null,"published_at":"2026-11-12T12:18:24+00:00","modified_at":"2026-11-12T12:18:24+00:00","first_seen_at":"2026-11-12T12:38:18+00:00","fetched_at":"2026-11-12T12:38:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}