Authenticated File Write via HA Failover Config Upload leads to RCE

Why this deserves its current priority

CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Affected scope and exposure questions

The current feed maps Zohocorp/DDI Central (generic). Check affected ranges and fixed versions before updating.

Recommended response

1. 1Check inventory. Check lockfiles and deployed manifests for Zohocorp/DDI Central.
2. 2Review the reported fix. Update Zohocorp/DDI Central to 6201 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

1. Published upstream

   Sep 28, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

2. Source modified

   Sep 28, 2026

   Evidence: source:cvelist:source_dates:source-dates:record

3. First seen by HOL

   Sep 28, 2026

Sources and claim methodology

• Source referencemanageengine.com

Related CVEs

• Missing Authorization on HA Failover Config allows Complete Data DestructionSame zohocorp/ddi central package
• Authenticated PowerShell Injection in DNS Query Resolution Policy leads to RCESame zohocorp/ddi central package
• Authenticated PowerShell Injection leads to RCESame zohocorp/ddi central package
• Authenticated File Write to RCE via keepalived in DDI CentralSame zohocorp/ddi central package
• Trusted Domain Project OpenDMARC opendmarc_policy.c opendmarc_policy_parse_dmarc exceptional conditionSame generic ecosystem
• Trusted Domain Project OpenDMARC opendmarc_policy.c strcasecmp exceptional conditionSame generic ecosystem