CVE-2026-95646

Description

Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.

References

https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-120875

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3