Live › vulnerability › CVE-2026-13594
Zoho's advisory says an improper access control flaw in Log360 and EventLog Analyzer builds 13025 to 13061 could let an adversary gain unauthorized access to the product. It was fixed in build 13062 on July 6, 2026 by strengthening authentication checks. The advisory does not say whether the attacker needs credentials or what the attack vector is. Reported by tran nghia via Zoho Bug Bounty.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 08:19 UTC. All times on this page are UTC.
Teams running self-hosted ManageEngine Log360 or EventLog Analyzer on builds 13025 to 13061. The vendor does not state the attack vector or whether authentication is needed, so treat internet- or network-reachable consoles as most at risk. Instances on build 13062 or later, or on builds before 13025, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| EventLog Analyzer | vendor | >= 13025, < 13062 | 13062 |
| Log360 | vendor | >= 13025, < 13062 | 13062 |
Update to build 13062 or later using the service pack (EventLog Analyzer or Log360 service packs page).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
This page as .md · .json · in your agent: get_signal("CVE-2026-13594")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.