CVE Watch10 nov 2026

CVE-2026-12573

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading t

CVSS

8.8

Alto

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 10 nov 2026 · Última mod.: 10 nov 2026 · CWE-77

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via DHCP pool name leading to arbitrary commands on managed Cisco routers.

Referencias oficiales

www.manageengine.comhttps://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-960537.8 ALT

—

——0Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.6h CVE-2026-839535.5 MED

—

——0Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an authorized attacker to disclose information locally.6h CVE-2026-1233878.0 ALT

—

——0Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.6h CVE-2026-1216628.6 ALT

—

——0Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.6h CVE-2026-1199898.2 ALT

—

——0Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.6h CVE-2026-1169308.8 ALT

—

——0Improper neutralization of special elements used in a command ('command injection') in SQL Server allows an unauthorized attacker to execute code over a network.5h