Zoho fixes eight ManageEngine flaws, including router command injection

Daily CyberSecurity reports that Zoho has fixed eight high-severity ManageEngine vulnerabilities affecting DDI Central and ADAudit Plus, with patches issued on 10 and 11 November 2026. The firm notes six flaws impact DDI Central — its DNS, DHCP and IP address management platform, including a command injection that could affect managed Cisco routers — while two flaws are SQL injection bugs in ADAudit Plus. The record lists CVSSv3 scores up to 8.8 and states there is no confirmed exploitation to date.

The publication highlights that one DDI Central vulnerability requires no login, and that ADAudit Plus defects enable SQL injection with low-privileged access. The piece emphasises applying the latest builds as the immediate action.

The article itemises the eight CVEs involved.

For DDI Central, CVE-2026-12573 (CVSS 8.8, CWE-77) allows command execution via a DHCP pool name; CVE-2026-95646 (CVSS 8.0, CWE-89) uses crafted Unicode to run device commands with an operator account; CVE-2026-12574 (CVSS 8.1, CWE-79) involves server-side HTML/JavaScript injection in analytics PDF reports; CVE-2026-12266 (CVSS 7.6, CWE-862) leaks LDAP bind password via a

weakly protected LDAP API; CVE-2026-95651 (CVSS 7.5, CWE-306) lets an unauthenticated attacker update the GSS-TSIG keytab on the Linux Node Agent; CVE-2026-12572 (CVSS 7.2, CWE-89) is an SQL injection in HA replication allowing commands as the PostgreSQL service account. For ADAudit Plus, CVE-2026-76981 (CVSS 8.8) is a second-order SQL injection in the custom reports module, and CVE-2026-12062 (CVSS 8.8) is a SQL injection in the Reports API.

Affected versions are listed as DDI Central builds prior to 6201 and prior to 6500, and ADAudit Plus builds prior to 8703 and prior to 8711. The article directs readers to upgrade to the latest builds and to rotate LDAP credentials, noting there have been no public exploits in the report.