CVE-2026-75864 - Vulnerability Details - OpenCVE

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zohocorp	Ddi Central

No data.

No data.

References

Link	Providers
https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75864.html

History

Thu, 12 Nov 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		Zohocorp ManageEngine DDI Central versions below 6301 is affected by an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.
Title		Broken Access Control
First Time appeared		Zohocorp Zohocorp ddi Central
Weaknesses		CWE-862
CPEs		cpe:2.3:a:zohocorp:ddi_central::::::::
Vendors & Products		Zohocorp Zohocorp ddi Central
References		https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75864.html
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Zohocorp

Published: 2026-11-12T12:21:11.903Z

Updated: 2026-11-12T12:21:11.903Z

Reserved: 2026-08-18T11:08:19.652Z

Link: CVE-2026-75864

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75864", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "Zohocorp", "dateReserved": "2026-08-18T11:08:19.652Z", "datePublished": "2026-11-12T12:21:11.903Z", "dateUpdated": "2026-11-12T12:21:11.903Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-11-12T12:21:11.903Z"}, "title": "Broken Access Control", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-862", "description": "CWE-862 \u2013 Missing Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-122", "descriptions": [{"lang": "en", "value": "CAPEC-122 \u2013 Privilege Abuse"}]}], "affected": [{"vendor": "Zohocorp", "product": "DDI Central", "versions": [{"status": "affected", "version": "0", "lessThan": "6301", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "6301"}]}]}], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine\u00a0DDI Central\u00a0versions below\u00a06301\u00a0is affected by\u00a0an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>Zohocorp ManageEngine </span>DDI Central<span> versions below </span>6301<span> is affected by </span>an improper authorization vulnerability that allowed authenticated non-administrative users to delete DNS zones outside their assigned scope."}]}], "references": [{"url": "https://www.manageengine.com/ca/dns-dhcp-ipam/security-updates/cve-2026-75864.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}