---
id: "CVE-2026-95646"
page: "https://infrastack.ai/live/CVE-2026-95646"
kind: "vulnerability"
aliases: ["CVE-2026-95646"]
title: "ManageEngine DDI Central: Unicode input lets operators inject device commands"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "DDI Central", "fixed": ["build 6500"], "affected": "<= 6.3.0 (build 6300)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cisco-ios", "command-injection", "ddi-central", "dhcp", "manageengine", "unicode", "vendor"]
not_affected_if: ["build-6500-or-later", "no-cisco-ios-dhcp-management", "version-above-6500"]
published_at: "2026-11-10T11:16:43+00:00"
first_seen_at: "2026-11-10T11:21:35+00:00"
updated_at: "2026-11-10T11:22:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95646", "first_seen_at": "2026-11-10T11:21:35+00:00"}, {"source": "analyst", "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html", "first_seen_at": "2026-11-10T11:22:38+00:00", "cites": ["https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html"]}]
exploit_sources: []
---

# ManageEngine DDI Central: Unicode input lets operators inject device commands

Link for people: https://infrastack.ai/live/CVE-2026-95646 (this .md is for agents)

ManageEngine DDI Central versions 6500 and below contain a Unicode-based command injection flaw in its Cisco IOS DHCP configuration feature. An authenticated cluster-scoped operator can inject crafted Unicode characters that cause unintended commands to run on managed devices.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DDI Central affected <= 6.3.0 (build 6300) fixed build 6500

## How to check

Check the DDI Central build in the console. Builds 6300 (6.3.0) and below are affected; 6500 is fixed. Exposed only if you manage Cisco IOS devices through DDI Central's DHCP configuration and have operators with DHCP edit permission on a cluster containing a Cisco device. Also check for stored DHCP pool client_name values containing U+2028.

## Fix

Update DDI Central to build 6500 or later via the service pack.

## Timeline

- 2026-11-10T11:21:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95646
- 2026-11-10T11:22:38+00:00 analyst https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html — Vendor advisory read: affected build 6300 and below (NVD's '6500 and below' is wrong, 6500 is the fix), fixed in build 6500 (Sept 17 2026). No PoC link or exploitation reported; vendor says PoC used a non-destructive command.

## Documents

- [advisory] ManageEngine DDI Central CVE-2026-95646 https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95646.html

## From the sources

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_