# CVE-2026-12264: Zoho ManageEngine DDI Central arbitrary file write in HA Failover Config sync

Source: https://junglewise.ai/threats/cve-2026-12264-zohocorp-manageengine-ddi-central-versions-before-6201-are  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-12264 · Severity: high · CVSS 8.8 · Published 2026-09-28

Zoho ManageEngine DDI Central is a DNS, DHCP, and IP address management platform used by enterprises to administer network infrastructure. Versions before 6201 allow attackers to write arbitrary files during HA failover configuration synchronization, leading to remote code execution with root privileges on affected servers.

Technologies: [Zoho ManageEngine DDI Central](https://junglewise.ai/threats/technologies/zoho-manageengine-ddi-central). Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-12264 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12264 being exploited in the wild.

**How severe is CVE-2026-12264?** High severity, with a CVSS score of 8.8, published 28 September 2026.

**Which products and versions are affected?** Zoho ManageEngine DDI Central before 6201.

**Is there a fix for CVE-2026-12264?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12264 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-12264?** Check whether you run Zoho ManageEngine DDI Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the HA Failover Config sync upload functionality, allowing arbitrary file write operations that bypass file path validation. An attacker can exploit this to write malicious files to arbitrary locations on the system, achieving remote code execution with root-level privileges. The issue is fixed in build 6201 and later.

## Affected products

- Zoho ManageEngine DDI Central before 6201

## Timeline

- 2026-09-28: disclosed

## References

- [https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html](https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html)

## Related threats

- [Zoho ManageEngine DDI Central server-side HTML injection in PDF generation](https://junglewise.ai/threats/cve-2026-12574-zoho-corporation-manageengine-ddi-central-versions-6200-and-below)
- [Zoho ManageEngine DDI Central SQL injection in HA replication](https://junglewise.ai/threats/cve-2026-12572-zoho-corporation-manageengine-ddi-central-version-below-6201-is)
- [Zoho ManageEngine DDI Central LDAP bind password exposure](https://junglewise.ai/threats/cve-2026-12266-zoho-corporation-manageengine-ddi-central-versions-6200-and-below)
- [Zoho ManageEngine DDI Central Unicode command injection in Cisco IOS DHCP](https://junglewise.ai/threats/cve-2026-95646-zoho-corporation-manageengine-ddi-central-versions-6500-and-below)