{"id":"CVE-2026-95651","kind":"vulnerability","aliases":["CVE-2026-95651"],"related":[],"title":"ManageEngine DDI Central Linux Node Agent: unauthenticated GSS-TSIG keytab replacement and BIND reload","description":"Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.","summary":"Linux Node Agent builds 6301 and below accepted a GSS-TSIG keytab update without authentication. A network client that could reach the agent listener could replace the active BIND keytab and trigger a BIND reload. Zoho says arbitrary DNS updates were not demonstrated. Fixed in build 6500 (Sept 17, 2026).","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"DDI Central Linux Node Agent","fixed":["build 6500"],"affected":"<= 6.3.1 (build 6301)","ecosystem":"vendor"}],"ecosystems":[],"tags":["bind","ddi-central","dns","gss-tsig","linux","manageengine","vendor","windows-active-directory"],"not_affected_if":["build-6500-or-later","no-gss-tsig","no-linux-node-agent"],"how_to_check":"- Check the DDI Central Linux Node Agent build on each host running BIND with GSS-TSIG: build 6301 (6.3.1) or below is affected, 6500 or later is fixed.\n- Check whether the Linux Node Agent listener is reachable from networks other than the DDI Central server; if so, restrict it.\n- Also check if a GSS-TSIG keytab (BIND) was changed unexpectedly or BIND reloaded without a change from you; the vendor page gives no detection guidance.","fix":"Update DDI Central and the Linux Node Agent instances to build 6500 or later using the service pack.","status":"open","published_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","triaged_at":"2026-11-10T11:21:57+00:00","updated_at":"2026-11-10T11:22:55+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-10T11:21:57Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"ManageEngine DDI Central: unauthenticated GSS-TSIG keytab update in Linux agent","impact":"high","summary":"ManageEngine DDI Central versions 6500 and below contain an unauthenticated GSS-TSIG keytab update flaw in the Linux Node Agent. The sources do not state what an attacker gains beyond altering the keytab.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","ddi-central","linux","dns","windows-active-directory"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker can alter the Kerberos keytab on the agent host","analyst_note":"Check the NVD entry and the Zoho advisory for the fixed version, the network exposure of the Linux Node Agent, and the impact of the keytab update.","how_to_check":"- Check the installed DDI Central version against `6500`\n- Look for the Linux Node Agent on hosts running DDI Central: unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running ManageEngine DDI Central version 6500 or below with the Linux Node Agent deployed. The sources do not say which configurations expose the agent to the network.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000702,"input_tokens":4534,"output_tokens":498,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the NVD entry and the Zoho advisory for the fixed version, the network exposure of the Linux Node Agent, and the impact of the keytab update.","search":"'-2026':17A,20A '-95651':18A,21A '17':91B '2026':92B '6301':46B '6500':89B,99C 'accept':49B 'activ':40B,70B 'agent':6A,26A,44B,65B,117C 'arbitrari':80B 'authent':57B 'bind':14A,27B,71B,76B 'build':45B,88B 'central':3A,23A,30B,97C 'client':60B 'corpor':94C 'could':62B,67B 'cve':16A,19A 'ddi':2A,22A,29B,96C 'ddi-centr':28B 'demonstr':85B 'directori':41B 'dns':31B,81B 'fix':86B 'gss':9A,33B,52B,108C 'gss-tsig':8A,32B,51B,107C 'keytab':11A,54B,72B,110C 'linux':4A,24A,35B,42B,115C 'listen':66B 'manageengin':1A,36B,95C 'network':59B 'node':5A,25A,43B,116C 'reach':63B 'reload':15A,77B 'replac':12A,68B 'say':79B 'sept':90B 'trigger':74B 'tsig':10A,34B,53B,109C 'unauthent':7A,106C 'updat':55B,82B,111C 'vendor':37B 'version':98C 'vulner':103C,112C 'window':39B 'windows-active-directori':38B 'without':56B 'zoho':78B,93C","nicknames":[],"mitigations":[],"who_affected":"Teams running ManageEngine DDI Central with the Linux Node Agent (managing BIND) on build 6301 or earlier. It matters most where GSS-TSIG secure dynamic DNS (Windows AD integration) is used and the agent listener is reachable by untrusted network clients. Windows-only agent deployments or builds 6500+ can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-10T11:22:55Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html","run_id":2441},"how_to_check":{"at":"2026-11-10T11:22:55Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html","run_id":2441},"who_affected":{"at":"2026-11-10T11:22:55Z","by":"analyst","doc":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html","run_id":2441}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["centrallinuxnodeagent","ddicentrallinuxnodeagent"],"ptokens":["agent","central","ddi","linux","node"],"labels":["bind","ddicentral","dns","gsstsig","high","linux","manageengine","vendor","windowsactivedirectory"],"campaign_type":null,"search_a":"'-2026':17A,20A '-95651':18A,21A 'agent':6A,26A 'bind':14A 'central':3A,23A 'cve':16A,19A 'ddi':2A,22A 'gss':9A 'gss-tsig':8A 'keytab':11A 'linux':4A,24A 'manageengin':1A 'node':5A,25A 'reload':15A 'replac':12A 'tsig':10A 'unauthent':7A","search_b":"'17':91B '2026':92B '6301':46B '6500':89B 'accept':49B 'activ':40B,70B 'agent':44B,65B 'arbitrari':80B 'authent':57B 'bind':27B,71B,76B 'build':45B,88B 'central':30B 'client':60B 'could':62B,67B 'ddi':29B 'ddi-centr':28B 'demonstr':85B 'directori':41B 'dns':31B,81B 'fix':86B 'gss':33B,52B 'gss-tsig':32B,51B 'keytab':54B,72B 'linux':35B,42B 'listen':66B 'manageengin':36B 'network':59B 'node':43B 'reach':63B 'reload':77B 'replac':68B 'say':79B 'sept':90B 'trigger':74B 'tsig':34B,53B 'updat':55B,82B 'vendor':37B 'window':39B 'windows-active-directori':38B 'without':56B 'zoho':78B","search_c":"'6500':99C 'agent':117C 'central':97C 'corpor':94C 'ddi':96C 'gss':108C 'gss-tsig':107C 'keytab':110C 'linux':115C 'manageengin':95C 'node':116C 'tsig':109C 'unauthent':106C 'updat':111C 'version':98C 'vulner':103C,112C 'zoho':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T11:16:43+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-95651","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95651","severity":null,"published_at":"2026-11-10T11:16:43+00:00","modified_at":"2026-11-10T11:16:43+00:00","first_seen_at":"2026-11-10T11:21:35+00:00","fetched_at":"2026-11-10T11:21:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-95651:2441","url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html","severity":null,"published_at":"2026-11-10T11:22:55+00:00","modified_at":"2026-11-10T11:22:55+00:00","first_seen_at":"2026-11-10T11:22:55+00:00","fetched_at":"2026-11-10T11:22:55+00:00","note":"Vendor advisory read: Linux Node Agent <= build 6301 affected, fixed in 6500. Vendor rates Critical; NVD says 6500 and below and CVSS 7.5 (A:H only), which conflicts with vendor; severity left unchanged. Arbitrary DNS updates not demonstrated. Sibling CVE-2026-95643 has the same title in vendor list; possibly a duplicate, code decides.","cites":["https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html","https://nvd.nist.gov/vuln/detail/CVE-2026-95651"]}],"documents":[{"id":114697,"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html","title":"ManageEngine DDI Central security update CVE-2026-95651","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":114698,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-95651","title":"NVD CVE-2026-95651","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}