Is CVE-2026-12573 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12573 being exploited in the wild.

How severe is CVE-2026-12573?

High severity, with a CVSS score of 8.8, published 10 November 2026.

Which products and versions are affected?

Zoho Corporation ManageEngine DDI Central 6200 and below.

Is there a fix for CVE-2026-12573?

Yes: fixed in Build 6201. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-12573 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-12573?

Check whether you run Zoho Corporation ManageEngine DDI Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12573: ManageEngine DDI Central Cisco IOS command injection via DHCP pool name

CVE-2026-12573 · Severity: high · CVSS 8.8 · Published 2026-11-10

ManageEngine DDI Central is a DNS, DHCP, and IP address management system that configures network devices including Cisco routers. A flaw in how DHCP pool names are processed allows an attacker to inject arbitrary Cisco IOS commands, leading to complete compromise of managed routers. An attacker could reconfigure or disable critical network infrastructure, redirect traffic, or establish persistent backdoors.

Vendors: Zoho Corporation.

Quick answers

Is CVE-2026-12573 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12573 being exploited in the wild.
How severe is CVE-2026-12573?: High severity, with a CVSS score of 8.8, published 10 November 2026.
Which products and versions are affected?: Zoho Corporation ManageEngine DDI Central 6200 and below.
Is there a fix for CVE-2026-12573?: Yes: fixed in Build 6201. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-12573 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-12573?: Check whether you run Zoho Corporation ManageEngine DDI Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Build 6201

Technical details

The vulnerability is a command injection flaw in the DHCP pool name handling that fails to sanitize user input before passing it to Cisco IOS command generation. An authenticated attacker with DDI Central access can craft a malicious DHCP pool name containing shell metacharacters or IOS command sequences that execute arbitrary commands on managed Cisco routers with the privileges of the management interface.

Affected products

Zoho Corporation ManageEngine DDI Central 6200 and below

Timeline

2026-11-10: disclosed

References

https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.