---
id: "CVE-2026-95651"
page: "https://infrastack.ai/live/CVE-2026-95651"
kind: "vulnerability"
aliases: ["CVE-2026-95651"]
title: "ManageEngine DDI Central Linux Node Agent: unauthenticated GSS-TSIG keytab replacement and BIND reload"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "DDI Central Linux Node Agent", "fixed": ["build 6500"], "affected": "<= 6.3.1 (build 6301)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bind", "ddi-central", "dns", "gss-tsig", "linux", "manageengine", "vendor", "windows-active-directory"]
not_affected_if: ["build-6500-or-later", "no-gss-tsig", "no-linux-node-agent"]
published_at: "2026-11-10T11:16:43+00:00"
first_seen_at: "2026-11-10T11:21:35+00:00"
updated_at: "2026-11-10T11:22:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-95651", "first_seen_at": "2026-11-10T11:21:35+00:00"}, {"source": "analyst", "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html", "first_seen_at": "2026-11-10T11:22:55+00:00", "cites": ["https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html", "https://nvd.nist.gov/vuln/detail/CVE-2026-95651"]}]
exploit_sources: []
---

# ManageEngine DDI Central Linux Node Agent: unauthenticated GSS-TSIG keytab replacement and BIND reload

Link for people: https://infrastack.ai/live/CVE-2026-95651 (this .md is for agents)

Linux Node Agent builds 6301 and below accepted a GSS-TSIG keytab update without authentication. A network client that could reach the agent listener could replace the active BIND keytab and trigger a BIND reload. Zoho says arbitrary DNS updates were not demonstrated. Fixed in build 6500 (Sept 17, 2026).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DDI Central Linux Node Agent affected <= 6.3.1 (build 6301) fixed build 6500

## How to check

- Check the DDI Central Linux Node Agent build on each host running BIND with GSS-TSIG: build 6301 (6.3.1) or below is affected, 6500 or later is fixed.
- Check whether the Linux Node Agent listener is reachable from networks other than the DDI Central server; if so, restrict it.
- Also check if a GSS-TSIG keytab (BIND) was changed unexpectedly or BIND reloaded without a change from you; the vendor page gives no detection guidance.

## Fix

Update DDI Central and the Linux Node Agent instances to build 6500 or later using the service pack.

## Timeline

- 2026-11-10T11:21:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-95651
- 2026-11-10T11:22:55+00:00 analyst https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html — Vendor advisory read: Linux Node Agent <= build 6301 affected, fixed in 6500. Vendor rates Critical; NVD says 6500 and below and CVSS 7.5 (A:H only), which conflicts with vendor; severity left unchanged. Arbitrary DNS updates not demonstrated. Sibling CVE-2026-95643 has the same title in vendor list; possibly a duplicate, code decides.

## Documents

- [advisory] ManageEngine DDI Central security update CVE-2026-95651 https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-95651.html
- [mentions] NVD CVE-2026-95651 https://nvd.nist.gov/vuln/detail/CVE-2026-95651

## From the sources

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab update vulnerability in the Linux Node Agent.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_