CVE-2026-12267

Published 28 September 2026 · tracked since 28 September 2026

Description

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-93348 HIGH 8.1
• CVE-2026-88808 HIGH 8.8
• CVE-2026-101861 MEDIUM 4.1
• CVE-2026-101079 LOW 2.8
• CVE-2026-93539 MEDIUM 5.4
• CVE-2026-96538
• CVE-2026-93537 MEDIUM 6.5
• CVE-2026-82929
• CVE-2026-82935
• CVE-2026-82323 HIGH 8.1

→ Open the live CVE board · all tools