by Kastro
Paper/Archive/CVE-2026-19422

CVE-2026-19422

Zohocorp DDI Central — Authentication Bypass

CVSS 9.1
critical.is priorityof 100
27
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0No EPSS score.000 × 200.0No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.

Affected

ProductAffectedFixed inSource
DDI Central< 63016301CNA

Scores by source

Zohocorp (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

References

refmanageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html