CVE-2026-19422 in zohocorp ddi central
LogPulse has assessed this CVE and a detection rule is being built.
What the vulnerability is
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.
Affected software: zohocorp ddi central
Scores
- CVSS: 9.1 (critical)
- EPSS: 2.19% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2026-11-12
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade ManageEngine DDI Central to build 6301 or later
Patch or upgrade. Build 6301 fixes an unauthenticated agent impersonation flaw in the Windows DNS/DHCP sync APIs and several authorization bypass and PowerShell injection flaws. Until patched, anyone who can reach the server can push DNS and DHCP changes.
Applies to: ManageEngine DDI Central builds below 6301
- Check the DDI Central build number shown in the product (About / build info).
- If the build is below 6301, download the upgrade pack for build 6301 or later from the ManageEngine DDI Central service packs page.
- Take a backup of the DDI Central database and configuration.
- Apply the upgrade pack following the ManageEngine upgrade instructions and restart the service.
- Upgrade the Windows DNS/DHCP agents if the upgrade notes ask for it.
- Until patched, restrict network access to the DDI Central server to onboarded Windows DNS/DHCP servers and admin workstations.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.