{"id":"CVE-2026-95646","aliases":[],"cve":{"records":[{"id":"CVE-2026-95646","source":"Zohocorp","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-09-22T11:31:02.170Z","published":"2026-11-10T10:51:21.107Z","modified":"2026-11-12T19:02:53.040Z"}],"publishers":[{"name":"Zohocorp","role":"CNA","organizationId":"0fc0942c-577d-436f-ae8e-945763c79b02","modified":"2026-11-10T10:51:21.107Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-11-12T19:02:53.040Z"}],"references":[{"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html","tags":[],"source":"Zohocorp"}],"weaknesses":[{"id":"CWE-77","description":"CWE-77 – Improper Neutralization of Special Elements Used in a Command ('Command Injection')","source":"Zohocorp"}],"applicability":[{"source":"Zohocorp","statements":[{"operator":"OR","nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*","versionStartIncluding":"0","versionEndExcluding":"6500"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-11-12T18:09:41.636772Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Authenticated Command Injection","titleSource":"Zohocorp","descriptionSource":"Zohocorp","description":"Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.","score":8,"severity":"high","published":"2026-11-10T10:51:21.107Z","modified":"2026-11-12T19:02:53.040Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Zohocorp","name":"DDI Central","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"6500","versionType":"custom"}],"defaultStatus":"unaffected","cpes":[],"source":"Zohocorp","url":"https://www.cve.org/CVERecord?id=CVE-2026-95646"}],"remediation":[],"references":["https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"],"sources":[{"name":"CVE","id":"CVE-2026-95646","modified":"2026-11-12T19:02:53.040Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-95646"}],"assessments":[{"source":"Zohocorp","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","score":8}],"sourceAffected":[],"observedAt":"2026-11-12T20:50:55.328Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T00:10:33.488Z"},"coverage":[{"source":"NVD","status":"no-result","checkedAt":"2026-11-10T11:05:31.224Z","attemptedAt":"2026-11-10T11:05:31.224Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-11-10T11:05:33.477Z","attemptedAt":"2026-11-10T11:05:33.477Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-11-10T11:05:31.224Z","attemptedAt":"2026-11-10T11:05:31.224Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-11-10T11:05:33.477Z","attemptedAt":"2026-11-10T11:05:33.477Z"}],"evidence":[],"aiSummary":{"text":"Zoho ManageEngine DDI Central versions 6500 and below have a command injection vulnerability in Cisco IOS DHCP configuration, allowing cluster-scoped operators to inject Unicode characters and execute unintended device commands. The vulnerability requires authenticated access. The impact is the execution of unintended device commands.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T11:01:02.915Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-95646"}]}}