CVE-2026-16900

HighCVSS 7.5

Published: 03/11/2026(UTC)Translated: 03/11/2026(UTC)NVD NIST

Summary

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing an unauthenticated actor to register a local collector by sending a specially crafted registration request.

Risk Assessment

An attacker without valid credentials could register a rogue collector and inject or intercept data, undermining the integrity of the logging system.

Recommendation

Update ManageEngine Log360 and EventLog Analyzer to a version newer than 13071. Review the registered collectors for unknown entries.

Other vulnerabilities in ManageEngine Log360

CVE-2026-13594Critical
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

Original NVD description (English source)

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS