{"id":"CVE-2026-13594","kind":"vulnerability","aliases":["CVE-2026-13594"],"related":[],"title":"ManageEngine Log360 and EventLog Analyzer builds 13025 to 13061: improper access control allows unauthorized access (fixed in 13062)","description":"Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.","summary":"Zoho's advisory says an improper access control flaw in Log360 and EventLog Analyzer builds 13025 to 13061 could let an adversary gain unauthorized access to the product. It was fixed in build 13062 on July 6, 2026 by strengthening authentication checks. The advisory does not say whether the attacker needs credentials or what the attack vector is. Reported by tran nghia via Zoho Bug Bounty.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EventLog Analyzer","fixed":["13062"],"affected":">= 13025, < 13062","ecosystem":"vendor"},{"name":"Log360","fixed":["13062"],"affected":">= 13025, < 13062","ecosystem":"vendor"}],"ecosystems":[],"tags":["eventlog-analyzer","infrastructure","log360","manageengine","self-hosted"],"not_affected_if":[],"how_to_check":"Find your build number in the product (Log360 or EventLog Analyzer web console, About/build info). Builds 13025 through 13061 are affected; 13062 or later is fixed. Builds below 13025 are not listed by the vendor as affected.","fix":"Update to build 13062 or later using the service pack (EventLog Analyzer or Log360 service packs page).","status":"open","published_at":"2026-11-03T08:17:15+00:00","first_seen_at":"2026-11-03T08:19:30+00:00","triaged_at":"2026-11-03T08:19:36+00:00","updated_at":"2026-11-03T08:20:19+00:00","category":"infrastructure","confidence":0.85,"triage":{"at":"2026-11-03T08:19:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"ManageEngine Log360 and EventLog Analyzer: unauthorized access flaw in versions 13062 and below","impact":"high","summary":"ManageEngine Log360 and EventLog Analyzer, versions 13062 and below, contain a flaw that lets an adversary gain unauthorized access to the product. The sources give a CVSS score of 9.1 but do not describe the exact mechanism or whether authentication is needed.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["manageengine","log360","eventlog-analyzer","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"adversary gains unauthorized access to the log analysis product","analyst_note":"Read the NVD entry and the Zoho advisory for the attack vector, auth requirement and fixed build; the sources give only the CVSS score and a generic description.","how_to_check":"- Check the installed build number in the product's web console or install directory against `13062`.\n- unknown for any other check; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running ManageEngine Log360 or EventLog Analyzer at version 13062 or earlier are in scope. The sources do not say which deployment settings or roles are required, so unknown. Teams running these log analysis products should look at them first.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000681,"input_tokens":4104,"output_tokens":541,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Read the NVD entry and the Zoho advisory for the attack vector, auth requirement and fixed build; the sources give only the CVSS score and a generic description.","search":"'-13594':21A,24A '-2026':20A,23A '13025':7A,52B '13061':9A,54B '13062':18A,70B,112C '2026':74B '6':73B 'access':11A,15A,43B,61B,128C 'adversari':58B,124C 'advisori':39B,80B 'allow':13A,122C 'analyz':5A,30B,50B,110C 'analyzer':26A 'attack':86B,92B 'authent':77B 'bounti':102B 'bug':101B 'build':6A,51B,69B 'check':78B 'control':12A,44B 'corpor':104C 'could':55B,121C 'credenti':88B 'cve':19A,22A 'eventlog':4A,25A,29B,49B,109C 'eventlog-analyz':28B 'fix':16A,67B 'flaw':45B 'gain':59B,126C 'host':36B 'improp':10A,42B 'infrastructur':31B 'issu':119C 'juli':72B 'let':56B 'log360':2A,27A,32B,47B,107C 'manageengin':1A,33B,106C 'need':87B 'nghia':98B 'product':64B,131C 'report':95B 'say':40B,83B 'self':35B 'self-host':34B 'strengthen':76B 'tran':97B 'unauthor':14A,60B,127C 'vector':93B 'version':111C 'via':99B 'vulner':116C 'whether':84B 'zoho':37B,100B,103C","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted ManageEngine Log360 or EventLog Analyzer on builds 13025 to 13061. The vendor does not state the attack vector or whether authentication is needed, so treat internet- or network-reachable consoles as most at risk. Instances on build 13062 or later, or on builds before 13025, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T08:20:19Z","by":"analyst","doc":"https://www.manageengine.com/log-management/release-notes.html","run_id":1466},"products":{"at":"2026-11-03T08:20:19Z","by":"analyst","doc":"https://www.manageengine.com/log-management/release-notes.html","run_id":1466},"how_to_check":{"at":"2026-11-03T08:20:19Z","by":"analyst","doc":"https://www.manageengine.com/log-management/release-notes.html","run_id":1466},"who_affected":{"at":"2026-11-03T08:20:19Z","by":"analyst","doc":"https://www.manageengine.com/log-management/release-notes.html","run_id":1466}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["analyzer","eventloganalyzer","log360"],"ptokens":["analyzer","eventlog","log360"],"labels":["critical","eventloganalyzer","infrastructure","log360","manageengine","selfhosted"],"first_public_at":"2026-11-03T08:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-13594","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13594","severity":null,"published_at":"2026-11-03T08:17:15+00:00","modified_at":"2026-11-03T08:17:15+00:00","first_seen_at":"2026-11-03T08:19:30+00:00","fetched_at":"2026-11-03T08:19:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-13594:1466","url":null,"severity":null,"published_at":"2026-11-03T08:20:19+00:00","modified_at":"2026-11-03T08:20:19+00:00","first_seen_at":"2026-11-03T08:20:19+00:00","fetched_at":"2026-11-03T08:20:19+00:00","note":"Vendor advisory read: affected 13025-13061, fixed 13062 (Jul 6 2026); triage title said '13062 and below', which was wrong. Mechanism/auth not disclosed. No exploitation or PoC seen. Sibling CVE-2026-16900/12263 are separate."}],"documents":[{"id":56476,"url":"https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html","title":"CVE-2026-13594: Improper Access Control vulnerability in Log360 and EventLog Analyzer","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":56477,"url":"https://www.manageengine.com/log-management/release-notes.html","title":"Log360 release notes, build 13071","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}