CVE-2026-75867 - Vulnerability Details - OpenCVE

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Zohocorp	Ddi Central

No data.

No data.

References

Link	Providers
https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75867.html

History

Thu, 12 Nov 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.
Title		Broken Access Control
First Time appeared		Zohocorp Zohocorp ddi Central
Weaknesses		CWE-863
CPEs		cpe:2.3:a:zohocorp:ddi_central::::::::
Vendors & Products		Zohocorp Zohocorp ddi Central
References		https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75867.html
Metrics		cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: Zohocorp

Published: 2026-11-12T12:26:47.217Z

Updated: 2026-11-12T12:26:47.217Z

Reserved: 2026-08-18T11:54:25.454Z

Link: CVE-2026-75867

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-75867", "assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "state": "PUBLISHED", "assignerShortName": "Zohocorp", "dateReserved": "2026-08-18T11:54:25.454Z", "datePublished": "2026-11-12T12:26:47.217Z", "dateUpdated": "2026-11-12T12:26:47.217Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02", "shortName": "Zohocorp", "dateUpdated": "2026-11-12T12:26:47.217Z"}, "title": "Broken Access Control", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-863", "description": "CWE-863 \u2013 Incorrect Authorization", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "CAPEC-180 \u2013 Exploiting Incorrectly Configured Access Control Security Levels"}]}], "affected": [{"vendor": "Zohocorp", "product": "DDI Central", "versions": [{"status": "affected", "version": "0", "lessThan": "6301", "versionType": "custom"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"operator": "OR", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndExcluding": "6301"}]}]}], "descriptions": [{"lang": "en", "value": "Zohocorp ManageEngine\u00a0DDI Central\u00a0versions below\u00a06301\u00a0is affected by\u00a0an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<span>Zohocorp ManageEngine </span>DDI Central<span> versions below </span>6301<span> is affected by </span>an authorization bypass vulnerability that allowed authenticated non-administrative users to modify Windows DHCP filter-list configurations across unauthorized clusters."}]}], "references": [{"url": "https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-75867.html"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}}}