CVE-2026-75867 · Vendor
NO FIX YET · SEE WHAT TO DO
ManageEngine DDI Central versions below 6301 let a logged-in non-administrative user change Windows DHCP filter-list settings on clusters they should not control. The flaw is an authorization bypass, so an attacker with a basic account can alter DHCP configuration beyond their rights.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run ManageEngine DDI Central below version 6301 with multiple DHCP clusters and non-administrative user accounts. Installations on version 6301 or later, or with no non-admin users, are not exposed by this flaw.
Not affected if no-non-admin-users, version-6301-or-later
Who cares ddi-central, manageengine, self-hosted, windows-dhcp
6301 are listed as affected.6301 or later.Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.