{"id":"CVE-2026-12264","published":"2026-09-28T12:17:36.597","lastModified":"2026-09-29T21:39:02.570","description":"Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Arbitrary file write via HA Failover Config sync upload leading to remote code execution.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-434"],"vendors":[],"products":[],"references":[{"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows an attacker to upload a file via HA Failover Config sync, leading to remote code execution. It matters because it can be exploited to gain full control over the system.","exploitability":"Exploitation requires access to the HA Failover Config sync feature and knowledge of the specific upload vulnerability. Precondition is that the affected version of Zohocorp ManageEngine DDI Central is in use.","blast_radius":"If exploited, the attacker could gain full control over the system, potentially leading to data loss, service disruption, and further compromise of the network.","remediation":"Upgrade to version 6201 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","upload","config-sync"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-30T09:06:55.906Z"}}