CVE-2026-12266: Zoho ManageEngine DDI Central LDAP bind password exposure

CVE-2026-12266 · Severity: high · CVSS 7.6 · Published 2026-11-10

ManageEngine DDI Central, which manages DNS, DHCP, and IP address administration across enterprise networks, exposes LDAP bind passwords through an inadequately protected API endpoint. An attacker with access to the LDAP settings API can retrieve stored passwords, potentially compromising directory authentication and enabling unauthorized access to network identity services.

Technologies: Zoho ManageEngine DDI Central. Vendors: Zoho.

Quick answers

Is CVE-2026-12266 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-12266 being exploited in the wild.
How severe is CVE-2026-12266?
High severity, with a CVSS score of 7.6, published 10 November 2026.
Which products and versions are affected?
Zoho ManageEngine DDI Central 6200 and below.
Is there a fix for CVE-2026-12266?
Yes: fixed in Build 6201. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12266 attacked?
It is attacked over the network.
Am I affected by CVE-2026-12266?
Check whether you run Zoho ManageEngine DDI Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Build 6201

Technical details

The LDAP settings API in DDI Central fails to properly protect LDAP bind credentials, allowing password retrieval through insufficient access controls. The vulnerability affects versions 6200 and below, with authentication likely required to access the API. Remediation is available in build 6201 and later.

Affected products

  • Zoho ManageEngine DDI Central 6200 and below

Timeline

  • 2026-11-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.