CVE-2026-95646 PUBLISHED

Authenticated Command Injection

Assigner: Zohocorp
Reserved: 22.09.2026 Published: 10.11.2026 Updated: 10.11.2026

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS Score: 8

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	High	Integrity Impact	High
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Zohocorp
Product	DDI Central
Versions	Default: unaffected affected from 0 to 6500 (excl.)

References

https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html

Problem Types

CWE-77 – Improper Neutralization of Special Elements Used in a Command ('Command Injection') CWE

Impacts

CAPEC-88 – OS Command Injection