# CVE-2026-75864

## Insufficient authorization in Windows DNS zone-scope API allowing unauthorized zone deletion fixed in build 6301

**Severity:** High

**CVE ID:** CVE-2026-75864

**Affected Software Version(s):** DDI Central version 6.3.0 (build 6300) and below

**Fixed Version:** Build 6301

**Fixed on:** August 5, 2026

## Details

ManageEngine DDI Central 6.3.0 build 6300 had an object-level authorization vulnerability in a Windows DNS zone-scope management API.

The affected deletion endpoint identified the requested DNS zone using a user-supplied object identifier but did not adequately verify whether the authenticated user was authorized to manage that zone. In particular, the endpoint did not consistently enforce administrator privileges or validate that the requested zone was mapped to the requesting user.

As a result, an authenticated non-administrative operator could submit the identifier of a DNS zone outside their assigned scope and delete it. Since the endpoint retrieved the object from the general DNS zone table, the issue could affect zones belonging to other users, clusters, or tenants.

The vulnerability has been fixed by enforcing mandatory authorization checks on the affected deletion operation. DDI Central now verifies that the requesting user is an administrator or has an applicable user-to-zone mapping for the requested DNS zone before processing the deletion. Requests involving zones outside the user’s assigned scope are rejected.

## Impact

Successful exploitation of this vulnerability could allow an authenticated operator to delete DNS zones that they were not authorized to manage.

This could result in DNS configuration loss, disruption of name resolution, service outages, and loss of tenant isolation in multi-cluster or multi-tenant deployments.

## Steps to upgrade

Update your DDI Central installation to the latest build 6301 using the applicable service pack.

After completing the upgrade, verify that the DDI Central Console is running the recommended build.

## Acknowledgements

This issue was reported by Tuan Anh 91.