CVE-2026-12269

Keepalived configuration injection through HA workflow leading to remote code execution as root fixed in build 6201

Severity: High

CVE ID: CVE-2026-12269

Affected Software Version(s): DDI Central 6.2.0 / Build 6200

Fixed Version: Build 6201

Fixed on: June 18, 2026

Details:

The ManageEngine DDI Central 6.2.0 build 6200 had a Keepalived configuration injection vulnerability in the HA configuration workflow. This issue could allow an authenticated operator-level user to modify the Keepalived configuration and potentially execute commands as root on the DDI Central host.

The vulnerability has been fixed by validating and sanitizing Keepalived configuration updates before they are written to the configuration file. Access to this endpoint is now restricted to administrator-level users.

Impact:

Successful exploitation of this vulnerability could result in arbitrary modification of the Keepalived configuration and remote code execution as root on the DDI Central host.

Steps to upgrade:

Update your DDI Central Console and Node Agent instances to the latest build 6201 using the service pack.

Acknowledgements:

This issue was reported by d3lt4_2410.