{"affected":[{"defaultStatus":"unaffected","product":"DDI Central","source":"CNA: Zohocorp","vendor":"Zohocorp","versions":[{"lessThan":"6500","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2026-95646","cwes":["CWE-77"],"description":"Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection vulnerability in the Cisco IOS DHCP configuration functionality. This vulnerability could allow cluster-scoped operators to inject specially crafted Unicode characters, resulting in the execution of unintended device commands.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8,"severity":"high","source":"CNA: Zohocorp","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794307881107,"publishedAt":1794307881107,"references":[{"source":"CNA: Zohocorp","tags":[],"url":"https://www.manageengine.com/dns-dhcp-ipam/security-updates/security-updates.html"}],"remediation":[],"revision":"48b245a30bb38848689969b28b1cb89469304969e87b5c6f1d85d2196bc79008","sources":[{"modifiedAt":1794307881107,"name":"CNA: Zohocorp","retrievedAt":1794308910744,"url":"https://www.cve.org/CVERecord?id=CVE-2026-95646"}],"ssvc":null,"status":"published","title":"Authenticated Command Injection","updatedAt":1794308910744}