ManageEngine patches high-severity SQL and command injection vulnerabilities in DDI Central and ADAudit Plus
On November 10 and 11, 2026, Zoho released patches for eight high-severity vulnerabilities affecting ManageEngine products DDI Central and ADAudit Plus. Six flaws impact DDI Central, including critical command injection bugs that allow low-privileged or even unauthenticated users to execute arbitrary commands on managed Cisco routers, posing significant risk to network infrastructure. The other two vulnerabilities are SQL injection issues in ADAudit Plus, requiring low-privileged login but enabling injection attacks that could compromise Active Directory audit data. Although none of these vulnerabilities have been confirmed as exploited in the wild or added to CISA's KEV catalog, the CVSS scores range up to 8.8, prompting urgent patching. Users are advised to upgrade to the latest builds of the affected products and restrict privileged access to mitigate these risks.
Entenda a falha
A vulnerabilidade
Zoho fixed eight high-severity flaws in ManageEngine DDI Central and ADAudit Plus. The most severe is CVE-2026-12573 (CVSS 8.8), command injection via a DHCP pool name that runs arbitrary commands on managed Cisco routers. CVE-2026-95646 (8.0) is a related Unicode-based command injection needing an operator account. Both ADAudit Plus bugs score 8.8 and need only a low-privileged login: CVE-2026-76981 (second-order SQL injection in custom reports) and CVE-2026-12062 (SQL injection in the Reports API). Other DDI Central flaws: CVE-2026-12574 (HTML/JavaScript injection in PDF reports exposing local files), CVE-2026-12266 (LDAP settings API leaks the bind password), CVE-2026-95651 (unauthenticated update of the GSS-TSIG keytab on the Linux Node Agent) and CVE-2026-12572 (admin SQL injection in HA replication, runs as the PostgreSQL account). Fixed in DDI Central 6201 (four flaws) and 6500 (CVE-2026-95651, CVE-2026-95646), and in ADAudit Plus 8703 (CVE-2026-12062) and 8711 (CVE-2026-76981).
Como funciona
In DDI Central, a value entered by a user, such as a DHCP pool name, is accepted by the application and later used when the product pushes configuration commands to a managed Cisco router. Because the value is carried into the command text, it can alter what the router is told to run. In ADAudit Plus, input sent to the custom reports module or the Reports API ends up inside a database query. In the second-order case, the data is stored first and then used in a query later, which is where the query is altered. The articles give no further step-by-step detail.
Por que é vulnerável
The articles describe the bugs as injection flaws: user-controlled input (pool names, Unicode characters, report parameters, stored report data) is not properly validated or neutralized before being used in router commands, SQL queries or server-side HTML rendering. The LDAP and keytab issues are weak protection of an API and an update function (the keytab one needs no authentication). The articles do not explain why they went unnoticed or detail what each fix changes.
Onde está
The articles name the DHCP pool name handling, the analytics PDF report generation, the LDAP settings API, the Linux Node Agent GSS-TSIG keytab update, HA replication, the ADAudit Plus custom reports module and the Reports API, but no files, functions or commits.
Como foi descoberta
The articles do not say who found the flaws or how. Zoho released the patches on November 10 and 11, 2026. The coverage says none of the eight is confirmed as exploited and none is in CISA's KEV catalog, though CISA lists nine other Zoho ManageEngine flaws.
Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 22:15.
Linha do tempo
-
ManageEngine patches high-severity SQL and command injection vulnerabilities in DDI Central and ADAudit Plus
ler a análise desta fonte ocultar
On November 10 and 11, 2026, Zoho released patches for eight high-severity vulnerabilities affecting ManageEngine products DDI Central and ADAudit Plus. Six flaws impact DDI Central, including critical command injection bugs that allow low-privileged or even unauthenticated users to execute arbitrary commands on managed Cisco routers, posing significant risk to network infrastructure. The other two vulnerabilities are SQL injection issues in ADAudit Plus, requiring low-privileged login but enabling injection attacks that could compromise Active Directory audit data. Although none of these vulnerabilities have been confirmed as exploited in the wild or added to CISA's KEV catalog, the CVSS scores range up to 8.8, prompting urgent patching. Users are advised to upgrade to the latest builds of the affected products and restrict privileged access to mitigate these risks.