CVE-2026-75868 · Vendor
NO FIX YET · SEE WHAT TO DO
ManageEngine DDI Central versions below 6301 let authenticated non-administrative users modify DHCP options on subnets belonging to clusters they are not authorized for. An attacker with a low-privilege account can alter network configuration they should not control.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Organizations running ManageEngine DDI Central below version 6301 where non-administrative users hold accounts. Exposure depends on the presence of clusters and subnets that those users should not be able to manage. Installations at 6301 or later are not affected by this flaw.
Not affected if no-non-admin-users, version-6301-or-later
Who cares ddi-central, dhcp, manageengine, windows
63016301 onwardZohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.