CVE-2026-12265 in DDI Central
Summary
by MITRE • 09/28/2026
Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/28/2026
The vulnerability identified in Zoho Corporation's ManageEngine DDI Central, specifically affecting versions prior to build 6201, represents a critical failure in the implementation of access controls within the High Availability (HA) failover mechanism. This flaw allows an attacker with network-level access to interact directly with internal administrative endpoints that are intended for use only by trusted system components during cluster synchronization and state replication processes. The core technical deficiency lies in the absence of robust authentication or authorization checks on these specific API endpoints, which facilitate database operations necessary for maintaining consistency across HA nodes. By exploiting this misconfiguration, a malicious actor can bypass standard user interface restrictions and issue commands directly to the underlying PostgreSQL database engine that manages DNS, DHCP, and IP address management data.
From an operational perspective, the impact of this vulnerability is severe due to its potential for destructive outcomes. Since the vulnerable endpoint grants access to perform administrative operations on the PostgreSQL instance, an attacker can execute arbitrary SQL statements or trigger actions that compromise the integrity, availability, and confidentiality of critical network infrastructure services. This could lead to the deletion of DNS records, corruption of DHCP lease databases, or complete denial of service by disrupting the synchronization process between HA nodes. Such disruptions would result in significant downtime for enterprise networks relying on DDI Central for name resolution and address management, potentially causing widespread connectivity issues across the organization's IT infrastructure.
This vulnerability aligns with CWE-269, which classifies Improper Privilege Assignment or Insufficient Access Control, as it involves a failure to enforce proper restrictions on actions performed by authenticated users or system processes. Furthermore, from an offensive security perspective, this flaw facilitates techniques associated with MITRE ATT&CK ID T1078, specifically Valid Accounts and Default Accounts, where attackers leverage improperly secured internal services that are often left accessible for administrative convenience but lack adequate segmentation. The exploitation path typically involves network-based interaction rather than complex application logic flaws, making it a high-risk issue for environments where the management interface is exposed to untrusted networks or lacks sufficient micro-segmentation controls.
To mitigate this risk, organizations running affected versions of ManageEngine DDI Central must immediately apply the vendor-provided patch that updates the software to version 6201 or later. This update addresses the underlying code deficiencies by implementing strict access control lists and authentication requirements for all HA failover endpoints. In addition to applying patches, administrators should review network segmentation policies to ensure that management interfaces are not accessible from untrusted zones such as the public internet or general user VLANs. Implementing zero-trust principles where even internal services require mutual TLS authentication can further reduce the attack surface associated with high-availability cluster communications and prevent unauthorized entities from interacting with sensitive database operations.