Live › vulnerability › CVE-2026-16900
An unauthenticated attacker can register as a local collector in EventLog Analyzer and Log360 by sending a crafted registration request. The vendor says this lets them impersonate a local collector, read sensitive configuration data and add unauthorized syslog sources to inject fabricated log data. Fixed in build 13071.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 08:19 UTC. All times on this page are UTC.
Organizations running ManageEngine EventLog Analyzer or Log360 at build 13070 or earlier. The vendor does not say the flaw depends on a non-default setting, so treat every self-hosted install below 13071 as exposed, especially where the server is reachable from untrusted networks. Teams relying on these logs for detection or audit should also treat their log data as possibly tampered with.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| EventLog Analyzer | vendor | <= 13070 | 13071 |
| Log360 | vendor | <= 13070 | 13071 |
13071 and below, but the vendor advisory and release notes name 13071 as the fixed build.) Also check whether the web console is reachable from untrusted networks, and review syslog sources and collector registrations for entries you did not addUpdate EventLog Analyzer or Log360 to build 13071 or later (released Aug 25, 2026); vendor service-pack pages: https://www.manageengine.com/products/eventlog/service-packs.html and https://www.manageengine.com/log-management/service-packs.html
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.
This page as .md · .json · in your agent: get_signal("CVE-2026-16900")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.