# CVE-2026-95645

## Command injection in the Windows DDI Agent's blocked-domain management functionality allowing remote command execution fixed in build 6500

**Severity:** High

**CVE ID:** CVE-2026-95645

**Affected Software Version(s):** DDI Central 6.3.1 / Build 6301 and below

**Fixed Version:** Build 6500

**Fixed on:** September 17, 2026

## Details

ManageEngine DDI Central had a command injection vulnerability in the Windows DDI Agent's clear_blocked_domains functionality.

The affected functionality did not adequately validate values received through the blocked-domain policy data before processing them on Windows systems. Specially crafted input could therefore be interpreted as part of a system command instead of being handled strictly as domain data. The reported issue was classified as a Remote Code Execution (RCE) vulnerability.

The vulnerability has been fixed by strengthening validation in the clear_blocked_domains workflow. Domain values received through the JSON payload are now validated before processing, and requests containing invalid domain data are rejected with an error instead of being passed further for execution.

As an additional security control, access to this functionality has been restricted so that the clear_blocked_domains operation can be initiated only by the DDI Central application server. Agent servers cannot independently initiate calls to this function, thereby limiting the execution path to the trusted application-server workflow.

## Impact

Successful exploitation of this vulnerability could allow an attacker with the ability to invoke the affected functionality to inject unintended commands into the Windows command-processing workflow.

Such commands could execute within the privileges available to the DDI Agent process, potentially affecting system resources accessible to that process.

## Steps to upgrade

Update your DDI Central Console and associated DDI Agent instances to the fixed build or later using the corresponding service pack. Customers running DDI Agents on Windows systems are strongly recommended to upgrade to the fixed version.

## Acknowledgements

This issue was reported by Zewei Zhang from NSFOCUS TIANJI Lab.