HackZoneLabs News
Newsletter

CVE-2026-75868

Broken Access Control

  • High 8.1

Description

Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authorization bypass vulnerability that allowed authenticated non-administrative users to modify DHCP options on subnets belonging to unauthorized clusters.

Key facts

Published
12 Nov 2026
Last changed
12 Nov 2026
Assigned by
Zohocorp
EPSS
1.119% likely to be exploited in the next 30 days, higher than 66.669% of CVEs (scores for 15 Nov 2026)

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 8.1CVSS 3.1, Highfrom the CNA (Zohocorp)CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

CAPEC-180 – Exploiting Incorrectly Configured Access Control Security Levels (CNA impact statement)

No explicit remediation statement is available on this page yet. Consult the original record and vendor references before choosing a fix.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
ZohocorpDDI Central
  • Default status: unaffected
  • 0 up to but excluding 6301 (affected)

Timeline

  1. 12 Nov 2026 Published

Weakness

References