Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-19422 |
| Alert Source | GitHub Advisory - Critical Vulnerability |
| CVE Publication Year | 2026 |
| Date Published | 2026-11-12 |
| Vendor | Zohocorp |
| Product | ManageEngine DDI Central |
| Vulnerability Type | authentication bypass, Windows DNS/DHCP server impersonation |
| CVSS Score | 9.1 (critical) |
| EPSS Score | No data |
| CISA KEV | No |
| Ransomware | Not confirmed |
Vulnerability Description
Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.
According to the vendor advisory, the affected endpoints did not adequately authenticate requests from Windows Node Agents — they identified the agent using the server_ip value supplied in the HTTP request body. An attacker who supplies the IP address of an onboarded Windows DNS or DHCP server can submit synchronization requests on its behalf and create, modify or delete DHCP subnet information, DNS zones, DNS zone scopes and DNS records associated with that server. Possible consequences include DNS traffic redirection, incorrect network configuration or disruption of DNS and DHCP management.
The fix enforces authentication and authorization checks on the affected endpoints — requests without valid authentication or the required authorization are rejected before reaching the API handlers. The vendor rates the issue as “Critical”; NVD scores it 9.1 on the CVSS scale.
Required Actions
- Update DDI Central to build 6301 or later using the vendor service pack.
- After the upgrade, verify that the DDI Central Console and all Windows Node Agent instances run the recommended versions.
- Review DNS zones, records and DHCP scopes managed by DDI Central for unexpected changes.
Who Is Affected?
The vulnerability affects Zohocorp ManageEngine DDI Central version 6.3.0 (build 6300) and earlier. DDI Central is used for centralized DNS, DHCP and IP address management (IPAM); the flaw concerns synchronization with Windows DNS and DHCP servers onboarded through Windows Node Agents.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
Frequently asked questions
What is the CVE-2026-19422 vulnerability?
CVE-2026-19422 is an authentication bypass in the Windows DNS and DHCP agent synchronization APIs of ManageEngine DDI Central. An unauthenticated attacker can impersonate an onboarded Windows server and make unauthorized changes to DNS and DHCP data. CVSS score: 9.1.
Does exploiting CVE-2026-19422 require authentication?
No. According to the vendor, the affected endpoints identified the agent by the server_ip value supplied in the HTTP request body, so knowing the IP address of an onboarded Windows DNS or DHCP server is enough.
How to protect against CVE-2026-19422?
Update DDI Central to build 6301 or later using the vendor service pack, then verify that the DDI Central Console and all Windows Node Agent instances run the recommended versions.
Who is affected by CVE-2026-19422?
Organizations running ManageEngine DDI Central version 6.3.0 (build 6300) or earlier that manage Windows DNS or DHCP servers through Windows Node Agents.
