CVE-2026-75864 in zohocorp ddi central
Exploitation of this CVE does not show up in logs, so there is no detection rule for it.
What the vulnerability is
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.
Affected software: zohocorp ddi central
Scores
- CVSS: 8.1 (high)
- EPSS: 1.02% chance of exploitation in the next 30 days
- CISA KEV: Not listed
- Published: 2026-11-12
What LogPulse has for it
- Detection rule: No
- Agent check (vulnerable version): No
- Mitigation: Yes, see below
How to mitigate it
Upgrade ManageEngine DDI Central to build 6301 or later
Patch or upgrade. Build 6301 fixes an unauthenticated agent impersonation flaw in the Windows DNS/DHCP sync APIs and several authorization bypass and PowerShell injection flaws. Until patched, anyone who can reach the server can push DNS and DHCP changes.
Applies to: ManageEngine DDI Central builds below 6301
- Check the DDI Central build number shown in the product (About / build info).
- If the build is below 6301, download the upgrade pack for build 6301 or later from the ManageEngine DDI Central service packs page.
- Take a backup of the DDI Central database and configuration.
- Apply the upgrade pack following the ManageEngine upgrade instructions and restart the service.
- Upgrade the Windows DNS/DHCP agents if the upgrade notes ask for it.
- Until patched, restrict network access to the DDI Central server to onboarded Windows DNS/DHCP servers and admin workstations.
Sources:
Source data: NIST NVD, CISA KEV and FIRST EPSS. LogPulse processes new CVEs every hour.
We build every detection with great care, but no two environments are the same. Log sources, parsing and configuration differ, so test a detection in your own environment before you rely on it.