Command Injection in ManageEngine DDI Central DNS Policy

ManageEngine DDI Central versions below 6201 are vulnerable to Command injection in Windows DNS Query Resolution Policy name field leading to remote code execution.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

ManageEngine DDI Central is a critical DNS and DHCP infrastructure management platform used by organizations worldwide to administer DNS resolution policies. CVE-2026-12267 exposes a command injection vulnerability in versions below 6201, specifically within the Windows DNS Query Resolution Policy name field. This vulnerability allows unauthenticated attackers to inject arbitrary commands that execute with the privileges of the DDI Central service, potentially compromising entire DNS infrastructures and enabling lateral movement throughout the network. Organizations managing DNS services—including enterprises, service providers, and government agencies—face immediate risk of remote code execution and loss of control over critical name resolution systems.

Casky's 323 mapped security skills leverage Claude's extended reasoning to detect the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance via DNS). When practitioners run queries against their DDI Central instances, Casky identifies anomalous input patterns in DNS policy name fields—such as command delimiters (|, ;, &&, backticks), escape sequences, and suspicious shell metacharacters—that signal injection attempts. The platform correlates these findings with reconnaissance behaviors where attackers probe DNS configurations and with execution-phase activities where malicious payloads trigger code execution. Practitioners would see flagged policy names containing embedded commands, network communications to unexpected external systems post-injection, and process execution logs showing child processes spawned from DDI Central services—all mapped directly to the CWE-20 (Improper Input Validation) root cause and enabling rapid incident response before infrastructure compromise occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-12267.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-12267

Casky has 323 skills that investigate the attack patterns behind CVE-2026-12267. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn