CVE-2026-19422

CVSS 9.1 (critical) · published 2026-11-12

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.

Weakness: CWE-306

Source: NVD CVE-2026-19422

References

• https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.