CVE-2026-12571

CriticalCVSS 9.8/10Last modified Oct 23, 2026

Description

An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-287CWE-640

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Aug 11, 2026
Last modified
Oct 23, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-125757.5DVP80ES3 with  Improper Resource Shutdown or Release vulnerability.CVE-2026-125767.5DVP80ES3 with Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability.CVE-2026-125778.7DVP80ES3 with Improperly Implemented Security Check for Standard vulnerability.CVE-2026-125788.4The affected product is vulnerable to a deserialization of untrusted data, which may allow an attacker to execute arbitrary code.CVE-2026-125797.4AS228T with Authentication Bypass VulnerabilityCVE-2026-12584.9The Mail Mint plugin for WordPress is vulnerable to blind SQL Injection via the 'forms', 'automation', 'email/templates', and 'contacts/impoCVE-2026-125805.4EasyFlow .NET developed by Digiwin has a Stored Cross-Site Scripting vulnerability, allowing authenticated remote attackers to inject persisCVE-2026-125817.5EasyFlow .NET developed by Digiwin has a Session Fixation vulnerability. If unauthenticated remote attackers replace a specific session ID fCVE-2026-125828.6The Library Management System WordPress plugin before 3.5.8 does not sanitize and escape a user-supplied parameter before using it in a SQL CVE-2026-125838.1The Newsletters WordPress plugin before 4.15 does not prevent deserialization of untrusted input that is stored through a public form, allowCVE-2026-125847.5The Payment Gateway for Redsys & WooCommerce Lite WordPress plugin before 7.0.2 does not verify the authenticity of incoming payment-provideCVE-2026-125858.1The Abandoned Cart Lite for WooCommerce WordPress plugin before 6.8.2 does not protect the integrity of its cart-recovery tokens or bind the