---
id: "CVE-2026-19422"
page: "https://infrastack.ai/live/CVE-2026-19422"
kind: "vulnerability"
aliases: ["CVE-2026-19422"]
title: "ManageEngine DDI Central: authentication bypass lets attackers change DNS and DHCP"
severity: "critical"
cvss: 9.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["ddi-central", "manageengine", "vendor", "windows-dhcp", "windows-dns"]
not_affected_if: ["not-ddi-central", "version-6301-or-later"]
published_at: "2026-11-12T13:17:16+00:00"
first_seen_at: "2026-11-12T13:38:24+00:00"
updated_at: "2026-11-12T13:38:42+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-19422", "first_seen_at": "2026-11-12T13:38:24+00:00"}]
exploit_sources: []
---

# ManageEngine DDI Central: authentication bypass lets attackers change DNS and DHCP

Link for people: https://infrastack.ai/live/CVE-2026-19422 (this .md is for agents)

ManageEngine DDI Central versions below 6301 have an authentication bypass in the APIs that sync Windows DNS and DHCP agents. An unauthenticated attacker can impersonate an onboarded Windows server and make unauthorized DNS and DHCP changes.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed DDI Central version against `6301`; versions below it are affected.

## Fix

- ManageEngine DDI Central: move to `6301` or later (per NVD description)

## Timeline

- 2026-11-12T13:38:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-19422

## From the sources

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_