CVE-2026-12574

CVSS 8.1 (high) · published 2026-11-10

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF generation leading to local file disclosure.

Weakness: CWE-79

Source: NVD CVE-2026-12574

References

• https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.