DDI CENTRAL · CVE-2026-95646 · Vendor
FIX → build 6500 ✓ verified
ManageEngine DDI Central versions 6500 and below contain a Unicode-based command injection flaw in its Cisco IOS DHCP configuration feature. An authenticated cluster-scoped operator can inject crafted Unicode characters that cause unintended commands to run on managed devices.
first public Nov 10, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams running ManageEngine DDI Central build 6300 (6.3.0) or below that manage Cisco IOS devices through its DHCP configuration. An authenticated non-administrator operator with DHCP edit permission on a cluster containing a Cisco device can put a U+2028 character in the DHCP pool client_name field, and Cisco IOS treats it as a command separator, so extra commands run on that device. It does not need user interaction or access to another cluster. Installs without Cisco IOS DHCP management can skip it.
Not affected if build-6500-or-later, no-cisco-ios-dhcp-management, version-above-6500
Who cares cisco-ios, command-injection, ddi-central, dhcp, manageengine, unicode
6.3.0) and below are affected; 6500 is fixedZoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to build 6500
Update DDI Central to build 6500 or later via the service pack.