ManageEngine DDI Central and ADAudit Plus Vulnerabilities Allow SQL Injection and Router Command Injection
Do Son 
TL;DR
Zoho fixed eight high-severity ManageEngine vulnerabilities on November 10 and 11, 2026. Six affect DDI Central, its DNS, DHCP and IP address management platform. The other two are SQL injection bugs in ADAudit Plus, an Active Directory auditing tool. Scores range from 7.2 to 8.8.
A low-privileged DDI Central user could push commands to managed Cisco routers, while ADAudit Plus users could inject SQL. One DDI Central flaw needs no login at all. Update DDI Central and ADAudit Plus to the latest builds now.
- Total: 8 CVEs
- Severity: 8 High
- Actively exploited: None confirmed
- Highest severity: 8.8 (High · CVSSv3) — CVE-2026-12573
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-12573 | 8.8 | CWE-77 | 6201 | Not exploited |
| CVE-2026-76981 | 8.8 | CWE-89 | 8711 | Not exploited |
| CVE-2026-12062 | 8.8 | CWE-89 | 8703 | Not exploited |
| CVE-2026-12574 | 8.1 | CWE-79 | 6201 | Not exploited |
| CVE-2026-95646 | 8 | CWE-77 | 6500 | Not exploited |
| CVE-2026-12266 | 7.6 | CWE-862 | 6201 | Not exploited |
| CVE-2026-95651 | 7.5 | CWE-306 | 6500 | Not exploited |
| CVE-2026-12572 | 7.2 | CWE-89 | 6201 | Not exploited |
Why It Matters
DDI Central controls core network services such as DNS and DHCP, and it can manage Cisco routers. As a result, a bug there can spill over onto network hardware. Meanwhile, ADAudit Plus stores sensitive Active Directory audit data.
Attackers have targeted ManageEngine before. In fact, CISA’s Known Exploited Vulnerabilities catalog lists nine Zoho ManageEngine flaws. None of these eight new bugs is in that catalog, and no attacks or public exploits have been reported.
How the Attack Works
DDI Central
- CVE-2026-12573 (CVSS 8.8): Command injection through a DHCP pool name leads to “arbitrary commands on managed Cisco routers.”
- CVE-2026-95646 (CVSS 8.0): A related flaw uses crafted Unicode characters to run unintended device commands. It requires an operator account.
- CVE-2026-12574 (CVSS 8.1): Server-side HTML and JavaScript injection in analytics PDF reports exposes local files.
- CVE-2026-12266 (CVSS 7.6): A weakly protected LDAP settings API leaks the LDAP bind password.
- CVE-2026-95651 (CVSS 7.5): An unauthenticated attacker can update the GSS-TSIG keytab on the Linux Node Agent.
- CVE-2026-12572 (CVSS 7.2): SQL injection in HA replication lets an admin run commands as the PostgreSQL service account.
ADAudit Plus
Both ADAudit Plus bugs score 8.8 and need only a low-privileged login. CVE-2026-76981 is a second-order SQL injection in the custom reports module. CVE-2026-12062 is a SQL injection in the Reports API.
Affected Versions
- DDI Central builds before 6201 (four flaws)
- DDI Central builds before 6500 (CVE-2026-95651 and CVE-2026-95646)
- ADAudit Plus builds before 8703 (CVE-2026-12062) and before 8711 (CVE-2026-76981)
Patch and Mitigation
Upgrade ADAudit Plus to build 8711 or later. For DDI Central, install the newest build listed on the ManageEngine DDI Central security updates page. ADAudit Plus details are in the ADAudit Plus CVE-2026-12062 advisory. In addition, limit who holds operator rights and rotate the LDAP bind password. Patching these ManageEngine vulnerabilities quickly also protects the routers that DDI Central manages.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
