CVE-2026-12571

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287CWE-640

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
zohocorpmanageengine_ddi_central< 6201

References

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1257113.5The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for BookingCVE-2026-1257127.5A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser. A remote sender able to reach an active media session can supply aCVE-2026-1257155.3Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke their commands, or uCVE-2026-125727.2Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username handling leading to cCVE-2026-125729Plack::Middleware::CSP versions before 0.03 for Perl send the Content Security Policy under the wrong header name, so browsers never enforceCVE-2026-125738.8Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading tCVE-2026-125748.1Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript injection in analytics PDF gCVE-2026-1257427.87-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt memory when a continuatiCVE-2026-1257436.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes Elementor Addon Elements addonCVE-2026-1257441.2Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API token. An attacker with read-oCVE-2026-1257454.3Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that allows authenticated attaCVE-2026-1257465.3Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooC
CVE-2026-12571: Critical severity, CVSS 9.8 | Vulnix