External risk intelligence

ManageEngine DDI Central Authentication Bypass Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-19422

ManageEngine DDI Central is a centralized infrastructure management tool often deployed as an edge or internal gateway for network services. While synchronization APIs may be internal-facing in some segments, the product's role as a management platform frequently involves network exposure to interact with distributed Windows DNS and DHCP servers, making remote reachability a common deployment pattern.

Missing Authentication

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Zoho ManageEngine DDI Central could allow unauthorized changes to DNS and DHCP services, impacting network operations. The issue stems from improper authentication in how the system synchronizes with Windows servers. While the direct business impact requires confirmation of your specific deployment, this vulnerability highlights potential risks to core network management functions.

Unauthenticated access can alter DNS and DHCP settings.
Centralized network management tools are frequent targets.
Confirm relevance and exposure of this specific tool.

Attack Path

How an attacker could exploit the issue

An attacker could impersonate onboarded Windows servers by exploiting a vulnerability in the synchronization APIs. This allows an unauthenticated user to bypass security measures and gain unauthorized control over DNS and DHCP modifications.

Unauthenticated remote access is required.
Vulnerable synchronization APIs are triggered.
Risk of unauthorized DNS and DHCP changes.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated user to bypass authentication when interacting with Windows DNS and DHCP agent synchronization APIs. This could lead to unauthorized modifications of DNS and DHCP settings.

DNS and DHCP configurations at risk.
Unauthorized API access could occur.
Disruption of network services may happen.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that Zohocorp ManageEngine DDI Central manages core network services, infrastructure or platform teams are likely responsible for its operation and security. The initial step involves identifying all deployed instances of DDI Central, confirming their network exposure and business criticality, and then associating each instance with its accountable owner to prioritize and plan remediation.

Infrastructure or platform teams own this.
Verify DDI Central's network exposure.
Plan risk-based remediation actions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Zohocorp ManageEngine DDI Central?

ManageEngine DDI Central is a software platform designed to centralize the management of DNS, DHCP, and IP address infrastructure. It functions as a hub for network teams to oversee and automate these critical services across an organization. By integrating with various network components, including Windows-based servers, it helps maintain consistent network connectivity and addressing, often serving as a gateway for infrastructure management.

What does CVE-2026-19422 mean for security?

This CVE represents an authentication bypass vulnerability, classified as CWE-306: Missing Authentication for Critical Function. In plain terms, it means the software fails to verify the identity of a user or system before allowing access to sensitive tasks. Specifically for this flaw, an unauthorized actor can interact with APIs intended only for trusted Windows servers, allowing them to bypass security checks entirely.

How is this authentication bypass triggered?

The vulnerability is triggered by sending specially crafted requests to the Windows DNS and DHCP agent synchronization APIs. An attacker does not need legitimate credentials to access these functions. The bug is limited to this specific synchronization process; it does not imply that every feature in the software is accessible without authentication.

Is my DDI Central instance at risk?

According to Halo Surface Signal, this software is often deployed as a gateway to manage distributed network services, frequently resulting in remote reachability. If your DDI Central instance is accessible over a network where an attacker can reach these synchronization APIs, it is considered exposed. Even internal deployments should be assessed if they are reachable from segments that are not strictly secured.

What should I do first to address this?

Begin by creating an inventory of all DDI Central instances running in your environment. Confirm the specific version for each to determine if they are below the 6301 threshold. Identify the network placement of these instances and verify which teams are responsible for their maintenance so you can coordinate the necessary updates to secure the affected API synchronization process.

References

www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.