Is CVE-2026-95646 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-95646 being exploited in the wild.

How severe is CVE-2026-95646?

High severity, with a CVSS score of 8, published 10 November 2026.

Which products and versions are affected?

Zoho ManageEngine DDI Central 6500 and below.

Is there a fix for CVE-2026-95646?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-95646 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-95646?

Check whether you run Zoho ManageEngine DDI Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-95646: Zoho ManageEngine DDI Central Unicode command injection in Cisco IOS DHCP

CVE-2026-95646 · Severity: high · CVSS 8 · Published 2026-11-10

Zoho ManageEngine DDI Central is a network configuration management system that administers DNS, DHCP, and IP address services across multiple servers and devices. Versions 6500 and below contain a vulnerability in Cisco IOS DHCP configuration handling that allows cluster operators to inject Unicode characters to execute arbitrary commands on managed network devices. An attacker with cluster-scoped operator privileges could compromise critical network infrastructure by injecting malicious configuration into routers and other devices.

Technologies: Zoho ManageEngine DDI Central. Vendors: Zoho.

Quick answers

Is CVE-2026-95646 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-95646 being exploited in the wild.
How severe is CVE-2026-95646?: High severity, with a CVSS score of 8, published 10 November 2026.
Which products and versions are affected?: Zoho ManageEngine DDI Central 6500 and below.
Is there a fix for CVE-2026-95646?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-95646 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-95646?: Check whether you run Zoho ManageEngine DDI Central at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Unicode-based command injection vulnerability exists in the Cisco IOS DHCP configuration functionality of DDI Central. Cluster-scoped operators can inject specially crafted Unicode characters that are not properly sanitized, allowing execution of unintended device commands on managed Cisco devices. This requires authenticated access with cluster operator privileges and affects versions 6500 and below.

Affected products

Zoho ManageEngine DDI Central 6500 and below

Timeline

2026-11-10: disclosed

References

https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.