Zoho ManageEngine DDI Central: Authentication bypass via synchronization APIs (CVE-2026-19422)
An authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs allows unauthenticated users to impersonate onboarded Windows servers and perform unauthorized modifications.
CVE search metadata
CVE search record: CVE-2026-19422. Severity: critical. CVSS: 9.1. KEV: no. Product: ManageEngine DDI Central. Brief: Zoho ManageEngine DDI Central: Authentication bypass via synchronization APIs (CVE-2026-19422). Brief link: https://feed.craftedsignal.io/briefs/2026-11-manageengine-ddi-auth-bypass-cve-2026-19422/
Triage facts
Revision 1- Applicability
- ManageEngine DDI Central
- Evidence
- Unknown
- Severity
- Critical
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 14:17 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Zoho ManageEngine DDI Central versions below 6301 are affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs. This vulnerability allows an unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.
Impact
Successful exploitation allows unauthenticated users to perform unauthorized DNS and DHCP modifications. The vulnerability is rated with a CVSS v3.1 base score of 9.1.