{"api_version":"1","generated_at":"2026-11-12T14:03:30+00:00","cve":"CVE-2026-19422","urls":{"html":"https://cve.report/CVE-2026-19422","api":"https://cve.report/api/cve/CVE-2026-19422.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-19422","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-19422"},"summary":{"title":"Authentication Bypass","description":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.","state":"PUBLISHED","assigner":"Zohocorp","published_at":"2026-11-12 13:17:16","updated_at":"2026-11-12 13:17:16"},"problem_types":["CWE-306","CWE-306 CWE-306 – Missing Authentication for Critical Function"],"metrics":[{"version":"3.1","source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"9.1","severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html","name":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html","refsource":"0fc0942c-577d-436f-ae8e-945763c79b02","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19422","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19422","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Zohocorp","product":"DDI Central","version":"affected 6301 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"DDI Central","vendor":"Zohocorp","versions":[{"lessThan":"6301","status":"affected","version":"0","versionType":"custom"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:zohocorp:ddi_central:*:*:*:*:*:*:*:*","versionEndExcluding":"6301","versionStartIncluding":"0","vulnerable":true}],"negate":false,"operator":"OR"}],"operator":"OR"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<span>Zohocorp ManageEngine&nbsp;</span>DDI Central<span>&nbsp;versions below&nbsp;</span>6301<span>&nbsp;is affected by&nbsp;</span>an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications."}],"value":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications."}],"impacts":[{"capecId":"CAPEC-115","descriptions":[{"lang":"en","value":"CAPEC-115 – Authentication Bypass"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":9.1,"baseSeverity":"CRITICAL","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 – Missing Authentication for Critical Function","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-12T12:16:50.068Z","orgId":"0fc0942c-577d-436f-ae8e-945763c79b02","shortName":"Zohocorp"},"references":[{"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/cve-2026-19422.html"}],"source":{"discovery":"UNKNOWN"},"title":"Authentication Bypass","x_generator":{"engine":"Vulnogram 1.0.5"}}},"cveMetadata":{"assignerOrgId":"0fc0942c-577d-436f-ae8e-945763c79b02","assignerShortName":"Zohocorp","cveId":"CVE-2026-19422","datePublished":"2026-11-12T12:16:50.068Z","dateReserved":"2026-08-10T10:54:36.168Z","dateUpdated":"2026-11-12T12:16:50.068Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-12 13:17:16","lastModifiedDate":"2026-11-12 13:17:16","problem_types":["CWE-306","CWE-306 CWE-306 – Missing Authentication for Critical Function"],"metrics":{"cvssMetricV31":[{"source":"0fc0942c-577d-436f-ae8e-945763c79b02","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","baseScore":9.1,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.2}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"19422","Ordinal":"1","Title":"Authentication Bypass","CVE":"CVE-2026-19422","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"19422","Ordinal":"1","NoteData":"Zohocorp ManageEngine DDI Central versions below 6301 is affected by an authentication bypass vulnerability in Windows DNS and DHCP agent synchronization APIs, allowing unauthenticated user to impersonate onboarded Windows servers and perform unauthorized DNS and DHCP modifications.","Type":"Description","Title":"Authentication Bypass"}]}}}