# CVE-2026-12574: Zoho ManageEngine DDI Central server-side HTML injection in PDF generation

Source: https://junglewise.ai/threats/cve-2026-12574-zoho-corporation-manageengine-ddi-central-versions-6200-and-below  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-10. Updated: 2026-11-10  
License: CC BY 4.0 with a link back

CVE-2026-12574 · Severity: high · CVSS 8.1 · Published 2026-11-10

Zoho ManageEngine DDI Central is a DNS, DHCP, and IP address management platform used to administer corporate networks. Versions 6200 and below contain a server-side HTML and JavaScript injection vulnerability in the analytics PDF generation feature that allows attackers to disclose sensitive local files from the server.

Technologies: [Zoho ManageEngine DDI Central](https://junglewise.ai/threats/technologies/zoho-manageengine-ddi-central). Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-12574 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12574 being exploited in the wild.

**How severe is CVE-2026-12574?** High severity, with a CVSS score of 8.1, published 10 November 2026.

**Which products and versions are affected?** Zoho ManageEngine DDI Central 6200 and below.

**Is there a fix for CVE-2026-12574?** Yes: fixed in Build 6201. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12574 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-12574?** Check whether you run Zoho ManageEngine DDI Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Build 6201

## Technical details

Server-side HTML/JavaScript injection in the analytics PDF generation functionality allows an attacker to inject malicious HTML or JavaScript code that is processed server-side, leading to local file disclosure. The vulnerability affects DDI Central versions 6200 and below and is fixed in build 6201.

## Affected products

- Zoho ManageEngine DDI Central 6200 and below

## References

- [https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html](https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html)

## Related threats

- [Zoho ManageEngine DDI Central SQL injection in HA replication](https://junglewise.ai/threats/cve-2026-12572-zoho-corporation-manageengine-ddi-central-version-below-6201-is)
- [Zoho ManageEngine DDI Central LDAP bind password exposure](https://junglewise.ai/threats/cve-2026-12266-zoho-corporation-manageengine-ddi-central-versions-6200-and-below)
- [Zoho ManageEngine DDI Central Unicode command injection in Cisco IOS DHCP](https://junglewise.ai/threats/cve-2026-95646-zoho-corporation-manageengine-ddi-central-versions-6500-and-below)
- [Zoho ManageEngine DDI Central arbitrary file write in HA Failover Config sync](https://junglewise.ai/threats/cve-2026-12264-zohocorp-manageengine-ddi-central-versions-before-6201-are)