CVE-2026-12265

Full vulnerability record from the local CVENow database.

Description

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations.

Severity

HIGH

CVSS score

8.8 (v3.1)

Vulnerability status

Awaiting Analysis

Source identifier

0fc0942c-577d-436f-ae8e-945763c79b02

Published

2026-09-28 13:17:21.550000

Last modified

2026-11-10 12:17:19.250000

View original CVE JSON

{
  "id": "CVE-2026-12265",
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02",
  "published": "2026-09-28T13:17:21.550",
  "lastModified": "2026-11-10T12:17:19.250",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations."
    }
  ],
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "Zohocorp",
          "product": "DDI Central",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "6201",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-09-28T12:57:43.994467Z",
          "id": "CVE-2026-12265",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ]
}