{"id":"CVE-2026-19422","kind":"vulnerability","aliases":["CVE-2026-19422"],"related":[],"title":"ManageEngine DDI Central: authentication bypass lets attackers change DNS and DHCP","description":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.","summary":"ManageEngine DDI Central versions below 6301 have an authentication bypass in the APIs that sync Windows DNS and DHCP agents. An unauthenticated attacker can impersonate an onboarded Windows server and make unauthorized DNS and DHCP changes.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ddi-central","manageengine","vendor","windows-dhcp","windows-dns"],"not_affected_if":["not-ddi-central","version-6301-or-later"],"how_to_check":"- Check the installed DDI Central version against `6301`; versions below it are affected.","fix":"- ManageEngine DDI Central: move to `6301` or later (per NVD description)","status":"open","published_at":"2026-11-12T13:17:16+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:42+00:00","updated_at":"2026-11-12T13:38:42+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-12T13:38:42Z","model":"claude-haiku-5-5","output":{"fix":"- ManageEngine DDI Central: move to `6301` or later (per NVD description)","reach":"network","title":"ManageEngine DDI Central: authentication bypass lets attackers change DNS and DHCP","impact":"high","summary":"ManageEngine DDI Central versions below 6301 have an authentication bypass in the APIs that sync Windows DNS and DHCP agents. An unauthenticated attacker can impersonate an onboarded Windows server and make unauthorized DNS and DHCP changes.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","ddi-central","windows-dns","windows-dhcp"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Attacker alters DNS and DHCP records across the network without credentials","analyst_note":"Confirm the affected reach (internet-facing or internal only) and check the vendor advisory for detection steps; the NVD entry gives only the description.","how_to_check":"- Check the installed DDI Central version against `6301`; versions below it are affected.\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["not-ddi-central","version-6301-or-later"],"who_is_affected":"Organisations running ManageEngine DDI Central below version 6301 that use its Windows DNS and DHCP agent synchronization. The sources do not say which deployment settings are required beyond that. Teams without DDI Central can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000731,"input_tokens":4564,"output_tokens":550,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-19422':14A,17A '-2026':13A,16A '6301':34B,71C 'affect':73C 'agent':48B,84C 'allow':87C 'api':41B,86C 'attack':7A,51B 'authent':4A,37B,76C 'bypass':5A,38B,77C 'central':3A,20B,31B,68C 'chang':8A,64B 'cve':12A,15A 'ddi':2A,19B,30B,67C 'ddi-centr':18B 'dhcp':11A,25B,47B,63B,83C,100C 'dns':9A,28B,45B,61B,81C,98C 'imperson':53B,91C 'let':6A 'make':59B 'manageengin':1A,21B,29B,66C 'modif':101C 'onboard':55B,92C 'perform':96C 'server':57B,94C 'sync':43B 'synchron':85C 'unauthent':50B,88C 'unauthor':60B,97C 'user':89C 'vendor':22B 'version':32B,69C 'vulner':78C 'window':24B,27B,44B,56B,80C,93C 'windows-dhcp':23B 'windows-dn':26B 'zohocorp':65C","nicknames":[],"mitigations":[],"who_affected":"Organisations running ManageEngine DDI Central below version 6301 that use its Windows DNS and DHCP agent synchronization. The sources do not say which deployment settings are required beyond that. Teams without DDI Central can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","ddicentral","manageengine","vendor","windowsdhcp","windowsdns"],"campaign_type":null,"search_a":"'-19422':14A,17A '-2026':13A,16A 'attack':7A 'authent':4A 'bypass':5A 'central':3A 'chang':8A 'cve':12A,15A 'ddi':2A 'dhcp':11A 'dns':9A 'let':6A 'manageengin':1A","search_b":"'6301':34B 'agent':48B 'api':41B 'attack':51B 'authent':37B 'bypass':38B 'central':20B,31B 'chang':64B 'ddi':19B,30B 'ddi-centr':18B 'dhcp':25B,47B,63B 'dns':28B,45B,61B 'imperson':53B 'make':59B 'manageengin':21B,29B 'onboard':55B 'server':57B 'sync':43B 'unauthent':50B 'unauthor':60B 'vendor':22B 'version':32B 'window':24B,27B,44B,56B 'windows-dhcp':23B 'windows-dn':26B","search_c":"'6301':71C 'affect':73C 'agent':84C 'allow':87C 'api':86C 'authent':76C 'bypass':77C 'central':68C 'ddi':67C 'dhcp':83C,100C 'dns':81C,98C 'imperson':91C 'manageengin':66C 'modif':101C 'onboard':92C 'perform':96C 'server':94C 'synchron':85C 'unauthent':88C 'unauthor':97C 'user':89C 'version':69C 'vulner':78C 'window':80C,93C 'zohocorp':65C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19422","severity":null,"published_at":"2026-11-12T13:17:16+00:00","modified_at":"2026-11-12T13:17:16+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}