ManageEngine DDI Central Authentication Bypass Fixed in Build 6301

A critical authentication bypass in Zohocorp ManageEngine DDI Central (CVE‑2026‑19422) allows an unauthenticated attacker to impersonate Windows DNS/DHCP servers and modify DNS/DHCP data. The vendor advisory lists affected versions 6.3.0/Build 6300 and lower, and the fix is available in Build 6301 (released August 5 2026). The CVSS score is 9.1 (critical). Although the CISA KEV catalog lists this CVE as a known exploited vulnerability, no active exploitation has been observed in the past two days. To protect your environment, upgrade to Build 6301 and verify that all DDI Central consoles and Windows Node Agents run the patched version. This update is essential for maintaining secure operations and ensures proper authentication checks are enforced. This patch addresses the authentication flaw that could otherwise allow unauthorized changes to DNS zones and DHCP scopes. ManageEngine Security Update