# CVE-2026-12268: ManageEngine DDI Central PowerShell command injection in DNS record push

Source: https://junglewise.ai/threats/cve-2026-12268-manageengine-ddi-central-versions-below-6201-are-vulnerable-to  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-28. Updated: 2026-09-28  
License: CC BY 4.0 with a link back

CVE-2026-12268 · Severity: high · CVSS 8.8 · Published 2026-09-28

ManageEngine DDI Central is a DNS and DHCP management platform used by enterprises to control domain name systems and IP address assignments. Versions before 6201 contain a PowerShell command injection flaw in the Windows DNS SPF/TXT record push functionality that allows attackers to execute arbitrary commands with system privileges, potentially compromising managed DNS infrastructure and enabling lateral movement across the network.

Technologies: [ManageEngine DDI Central](https://junglewise.ai/threats/technologies/ddi-central). Vendors: [ManageEngine](https://junglewise.ai/threats/vendors/manageengine).

## Quick answers

**Is CVE-2026-12268 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12268 being exploited in the wild.

**How severe is CVE-2026-12268?** High severity, with a CVSS score of 8.8, published 28 September 2026.

**Which products and versions are affected?** ManageEngine DDI Central before 6201.

**Is there a fix for CVE-2026-12268?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-12268 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-12268?** Check whether you run ManageEngine DDI Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the Windows DNS SPF/TXT record push component where user-supplied input is not properly sanitized before being passed to PowerShell commands. An attacker with network access to DDI Central can inject malicious PowerShell commands that execute on Windows DNS servers managed by the platform. The flaw requires no authentication and allows remote code execution with the privileges of the DDI Central service account.

## Affected products

- ManageEngine DDI Central before 6201

## Timeline

- 2026-09-28: disclosed

## References

- [https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html](https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html)

## Related threats

- [ManageEngine DDI Central insufficient access control in HA failover endpoint](https://junglewise.ai/threats/cve-2026-12265-zohocorp-manageengine-ddi-central-versions-before-6201-are)
- [ManageEngine DDI Central command injection in DNS Query Resolution Policy](https://junglewise.ai/threats/cve-2026-12267-manageengine-ddi-central-versions-below-6201-are-vulnerable-to)
- [ManageEngine DDI Central authentication bypass in password-reset](https://junglewise.ai/threats/cve-2026-12571-manageengine-ddi-central-authentication-bypass-in-password-reset)