CVE-2026-12266: high-severity vulnerability in Zohocorp DDI Central
Authenticated Broken Access Control
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
18Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.6
Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through insufficiently protected LDAP settings API.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Affected products
Zohocorp · DDI CentralRelated CVEs — Zohocorp DDI Central
In the same product, most dangerous first.
CVE-2026-12269HIGHAuthenticated File Write to RCE via keepalived in DDI CentralEPSS 7.0%CVE-2026-12268HIGHAuthenticated PowerShell Injection leads to RCEEPSS 4.7%CVE-2026-12267HIGHAuthenticated PowerShell Injection in DNS Query Resolution Policy leads to RCEEPSS 3.6%CVE-2026-12264HIGHAuthenticated Arbitrary File WriteEPSS 2.0%CVE-2026-12265HIGHAuthenticated Broken Access ControlEPSS 0.9%CVE-2026-12574HIGHServer-Side HTML InjectionEPSS —