---
id: "CVE-2026-19421"
page: "https://infrastack.ai/live/CVE-2026-19421"
kind: "vulnerability"
aliases: ["CVE-2026-19421"]
title: "ManageEngine DDI Central: PowerShell injection via DNS TXT record values"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ddi-central", "infrastructure", "manageengine", "windows", "windows-dns"]
not_affected_if: ["fixed-version", "no-ddi-central"]
published_at: "2026-11-12T12:18:24+00:00"
first_seen_at: "2026-11-12T12:38:18+00:00"
updated_at: "2026-11-12T12:40:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19421", "first_seen_at": "2026-11-12T12:38:18+00:00"}]
exploit_sources: []
---

# ManageEngine DDI Central: PowerShell injection via DNS TXT record values

Link for people: https://infrastack.ai/live/CVE-2026-19421 (this .md is for agents)

ManageEngine DDI Central versions below 6301 do not validate TXT record values before passing them to PowerShell during Windows DNS operations. An attacker who can supply a crafted TXT record value can inject PowerShell commands that run on the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DDI Central version in the product's about page or install directory; versions below `6301` are affected.
- Confirm whether DDI Central manages Windows DNS zones in your environment.

## Fix

- ManageEngine DDI Central: upgrade to `6301` or later.

## Timeline

- 2026-11-12T12:38:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19421

## From the sources

Zohocorp ManageEngine DDI Central versions below 6301 is affected by a PowerShell injection vulnerability due to insufficient validation of user-supplied TXT record values in Windows DNS operations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_