Zohocorp ManageEngine Ddi Central vulnerabilities

3 CVEs affecting Zohocorp ManageEngine Ddi Central, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-12571, published 2026-08-11.

More from Zohocorp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-12571, published 2026-08-11. Critical severity, CVSS 9.8. EPSS: 3.3% chance of exploitation in the next 30 days. An authentication bypass in ManageEngine DDI Central's password-reset workflow allows account takeover.
• CVE-2024-5471, published 2024-07-17. Critical severity, CVSS 9.8. EPSS: 2.5% chance of exploitation in the next 30 days. Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys.
• CVE-2024-27311, published 2024-07-17. High severity, CVSS 8.8. EPSS: 1.5% chance of exploitation in the next 30 days. Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to directory traversal vulnerability which allows the user to upload new files to the server folder.