CVE-2026-75868 in DDI Central
Summary
by MITRE • 11/12/2026
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/12/2026
The identified security flaw in Zoho Corporation's ManageEngine DDI Central, specifically affecting versions prior to build 6301, represents a critical failure in the application’s access control mechanisms. This vulnerability is classified as an authorization bypass, which falls under the broader category of broken access control vulnerabilities defined by the Common Weakness Enumeration (CWE) standard as CWE-284: Improper Access Control. In this specific instance, the flaw allows authenticated users who do not possess administrative privileges to perform actions that should be strictly reserved for system administrators. The core technical issue lies in the server-side validation logic, which fails to adequately verify whether a non-administrative user has the requisite permissions to modify DHCP options on subnets associated with clusters they are not authorized to manage. This indicates a lack of proper object-level authorization checks when processing requests related to subnet configuration changes.
From an operational perspective, this vulnerability poses significant risks to network integrity and availability. DHCP services are fundamental to IP address management within enterprise networks, ensuring that devices receive correct network configurations such as IP addresses, subnets, gateways, and DNS servers. By allowing unauthorized users to modify these options on specific clusters, attackers could disrupt service for legitimate clients by assigning incorrect or malicious configuration parameters. This could lead to denial of service conditions where affected devices fail to connect to the network or are directed to rogue infrastructure. Furthermore, such modifications could facilitate man-in-the-middle attacks if DNS server addresses were altered to point to attacker-controlled servers, thereby enabling traffic interception and potential data exfiltration. The ability to alter these settings without proper oversight undermines the principle of least privilege and compromises the overall security posture of the network management system.
This vulnerability aligns with tactics observed in advanced persistent threats where attackers leverage existing credentials to escalate privileges or manipulate critical infrastructure components. It corresponds to techniques found within the MITRE ATT&CK framework, particularly those related to Defense Evasion via permission modification and Impact via service disruption. The exploitation does not require complex privilege escalation exploits since it relies on valid authentication tokens that are simply misused due to insufficient server-side validation. This makes detection challenging as the actions appear legitimate from an authentication standpoint but violate policy-based access controls.
To mitigate this risk, organizations running ManageEngine DDI Central versions below 6301 must immediately apply the vendor-provided patch or upgrade to version 6301 or later where these authorization checks have been corrected. Until patches are applied, administrators should enforce strict network segmentation and monitor logs for unusual DHCP configuration changes initiated by non-administrative accounts. Implementing additional monitoring rules that alert on any modification of subnet options can help detect potential exploitation attempts in real-time. Regular audits of user permissions and adherence to the principle of least privilege across all DDI management interfaces are essential preventive measures against similar access control failures.