{"id":"CVE-2026-75869","kind":"vulnerability","aliases":["CVE-2026-75869"],"related":[],"title":"ManageEngine DDI Central: authorization bypass lets users run commands on DHCP servers","description":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass and PowerShell command injection vulnerability that allowed authenticated non-administrative users to target unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers through crafted DNS suffix values.","summary":"ManageEngine DDI Central before build 6301 lets an authenticated non-administrative user reach DHCP subnets they should not control. Crafted DNS suffix values can be passed into PowerShell, so an attacker may execute arbitrary commands on managed Windows DHCP servers.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ddi-central","manageengine","powershell","vendor","windows-dhcp"],"not_affected_if":["build-6301-or-later","no-windows-dhcp-management"],"how_to_check":"- Check the installed DDI Central build number in the product's About or version page; `unknown` if the sources do not give the path\n- Check whether non-administrative accounts can use DHCP subnet management in DDI Central","fix":"- ManageEngine DDI Central builds below `6301`: move to build `6301` or later","status":"open","published_at":"2026-11-12T13:17:16+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","triaged_at":"2026-11-12T13:38:46+00:00","updated_at":"2026-11-12T13:38:46+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-11-12T13:38:46Z","model":"claude-haiku-5-5","output":{"fix":"- ManageEngine DDI Central builds below `6301`: move to build `6301` or later","reach":"network","title":"ManageEngine DDI Central: authorization bypass lets users run commands on DHCP servers","impact":"high","summary":"ManageEngine DDI Central before build 6301 lets an authenticated non-administrative user reach DHCP subnets they should not control. Crafted DNS suffix values can be passed into PowerShell, so an attacker may execute arbitrary commands on managed Windows DHCP servers.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","ddi-central","windows-dhcp","powershell"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs arbitrary commands on managed Windows DHCP servers","analyst_note":"Confirm the exact affected version range and whether a DNS suffix input is required, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-75869 and the Zoho advisory.","how_to_check":"- Check the installed DDI Central build number in the product's About or version page; `unknown` if the sources do not give the path\n- Check whether non-administrative accounts can use DHCP subnet management in DDI Central","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-windows-dhcp-management","build-6301-or-later"],"who_is_affected":"Teams that run ManageEngine DDI Central below build 6301 and manage Windows DHCP servers through it are exposed. The flaw needs a logged-in user without administrator rights, so sites where only administrators can log in to DDI Central are lower risk. Sites that do not use DDI Central to manage Windows DHCP can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000792,"input_tokens":4575,"output_tokens":669,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-75869':15A,18A '6301':33B,75C 'administr':39B,92C 'affect':77C 'allow':88C 'arbitrari':62B,103C 'attack':59B 'authent':36B,89C 'author':4A,80C 'build':32B 'bypass':5A,81C 'central':3A,21B,30B,72C 'command':9A,63B,84C,104C 'control':47B 'craft':48B,111C 'cve':13A,16A 'ddi':2A,20B,29B,71C 'ddi-centr':19B 'dhcp':11A,27B,42B,67B,98C,108C 'dns':49B,112C 'execut':61B,102C 'inject':85C 'let':6A,34B 'manag':65B,106C 'manageengin':1A,22B,28B,70C 'may':60B 'non':38B,91C 'non-administr':37B,90C 'pass':54B 'potenti':101C 'powershel':23B,56B,83C 'reach':41B 'run':8A 'server':12A,68B,109C 'subnet':43B,99C 'suffix':50B,113C 'target':95C 'unauthor':96C 'user':7A,40B,93C 'valu':51B,114C 'vendor':24B 'version':73C 'vulner':86C 'window':26B,66B,97C,107C 'windows-dhcp':25B 'zohocorp':69C","nicknames":[],"mitigations":[],"who_affected":"Teams that run ManageEngine DDI Central below build 6301 and manage Windows DHCP servers through it are exposed. The flaw needs a logged-in user without administrator rights, so sites where only administrators can log in to DDI Central are lower risk. Sites that do not use DDI Central to manage Windows DHCP can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ddicentral","high","manageengine","powershell","vendor","windowsdhcp"],"campaign_type":null,"search_a":"'-2026':14A,17A '-75869':15A,18A 'author':4A 'bypass':5A 'central':3A 'command':9A 'cve':13A,16A 'ddi':2A 'dhcp':11A 'let':6A 'manageengin':1A 'run':8A 'server':12A 'user':7A","search_b":"'6301':33B 'administr':39B 'arbitrari':62B 'attack':59B 'authent':36B 'build':32B 'central':21B,30B 'command':63B 'control':47B 'craft':48B 'ddi':20B,29B 'ddi-centr':19B 'dhcp':27B,42B,67B 'dns':49B 'execut':61B 'let':34B 'manag':65B 'manageengin':22B,28B 'may':60B 'non':38B 'non-administr':37B 'pass':54B 'powershel':23B,56B 'reach':41B 'server':68B 'subnet':43B 'suffix':50B 'user':40B 'valu':51B 'vendor':24B 'window':26B,66B 'windows-dhcp':25B","search_c":"'6301':75C 'administr':92C 'affect':77C 'allow':88C 'arbitrari':103C 'authent':89C 'author':80C 'bypass':81C 'central':72C 'command':84C,104C 'craft':111C 'ddi':71C 'dhcp':98C,108C 'dns':112C 'execut':102C 'inject':85C 'manag':106C 'manageengin':70C 'non':91C 'non-administr':90C 'potenti':101C 'powershel':83C 'server':109C 'subnet':99C 'suffix':113C 'target':95C 'unauthor':96C 'user':93C 'valu':114C 'version':73C 'vulner':86C 'window':97C,107C 'zohocorp':69C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T13:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75869","severity":null,"published_at":"2026-11-12T13:17:16+00:00","modified_at":"2026-11-12T13:17:16+00:00","first_seen_at":"2026-11-12T13:38:24+00:00","fetched_at":"2026-11-12T13:38:24+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}