CVE-2026-12572

Published 10 November 2026 · tracked since 11 November 2026

Description

Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to command execution as the PostgreSQL service account.

References

• NVD — National Vulnerability Database
• CVE.org record (MITRE)
• CISA Known Exploited Vulnerabilities catalog

Latest tracked vulnerabilities

• CVE-2026-123480 MEDIUM 6.5
• CVE-2026-118414 MEDIUM 5.4
• CVE-2026-118413 MEDIUM 5.4
• CVE-2026-118411 HIGH 8.8
• CVE-2026-105154 MEDIUM 6.1
• CVE-2026-105153 HIGH 7.7
• CVE-2026-125451 MEDIUM 6.5
• CVE-2026-119615 HIGH 8.8
• CVE-2026-119097 MEDIUM 6.4
• CVE-2026-103883 HIGH 8.8

→ Open the live CVE board · all tools