{"id":"CVE-2026-16900","kind":"vulnerability","aliases":["CVE-2026-16900"],"related":[],"title":"ManageEngine Log360 and EventLog Analyzer: collector registration bypasses authentication","description":"Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.","summary":"An unauthenticated attacker can register as a local collector in EventLog Analyzer and Log360 by sending a crafted registration request. The vendor says this lets them impersonate a local collector, read sensitive configuration data and add unauthorized syslog sources to inject fabricated log data. Fixed in build 13071.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EventLog Analyzer","fixed":["13071"],"affected":"<= 13070","ecosystem":"vendor"},{"name":"Log360","fixed":["13071"],"affected":"<= 13070","ecosystem":"vendor"}],"ecosystems":[],"tags":["eventlog-analyzer","log360","manageengine","self-hosted","siem","vendor"],"not_affected_if":["build-13071-or-later","unknown"],"how_to_check":"Check the installed build of Log360 or EventLog Analyzer. Builds 13070 and earlier are affected per the vendor; 13071 is fixed. (NVD says '13071 and below', but the vendor advisory and release notes name 13071 as the fixed build.) Also check whether the web console is reachable from untrusted networks, and review syslog sources and collector registrations for entries you did not add.","fix":"Update EventLog Analyzer or Log360 to build 13071 or later (released Aug 25, 2026); vendor service-pack pages: https://www.manageengine.com/products/eventlog/service-packs.html and https://www.manageengine.com/log-management/service-packs.html","status":"open","published_at":"2026-11-03T08:17:15+00:00","first_seen_at":"2026-11-03T08:19:30+00:00","triaged_at":"2026-11-03T08:19:36+00:00","updated_at":"2026-11-03T08:20:38+00:00","category":"vendor","confidence":0.85,"triage":{"at":"2026-11-03T08:19:36Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"ManageEngine Log360 and EventLog Analyzer: collector registration bypasses authentication","impact":"medium","summary":"Versions 13071 and below of ManageEngine Log360 and EventLog Analyzer let an unauthenticated attacker register a local collector by sending a crafted request. The sources do not say what a registered collector can then reach.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["manageengine","log360","eventlog-analyzer","siem"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"unauthenticated attacker registers a rogue collector on the server","analyst_note":"Confirm the fixed build, what a rogue collector can access, and whether the flaw depends on the collector feature; check the vendor advisory and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-16900.","how_to_check":"- Check the installed Log360 or EventLog Analyzer build number against the affected range (13071 and below)\n- unknown for any other check, the sources do not say","plain_action":"","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running ManageEngine Log360 or EventLog Analyzer at version 13071 or below are exposed. The sources do not say whether the flaw depends on a non-default setting or on the collector feature being used, so treat any affected build as in scope until the vendor says otherwise.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000692,"input_tokens":4118,"output_tokens":560,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed build, what a rogue collector can access, and whether the flaw depends on the collector feature; check the vendor advisory and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-16900.","search":"'-16900':12A,15A '-2026':11A,14A '13071':76B,84C 'actor':99C 'add':64B 'allow':97C 'analyz':5A,21B,40B,82C 'analyzer':17A 'attack':31B 'authent':9A,91C 'build':75B 'bypass':8A,92C 'collector':6A,37B,58B,95C,104C 'configur':61B 'craft':46B,109C 'cve':10A,13A 'data':62B,72B 'eventlog':4A,16A,20B,39B,81C 'eventlog-analyz':19B 'fabric':70B 'fix':73B 'host':26B 'imperson':55B 'inject':69B 'let':53B 'local':36B,57B,94C,103C 'log':71B 'log360':2A,18A,22B,42B,79C 'manageengin':1A,23B,78C 'read':59B 'regist':33B,101C 'registr':7A,47B,96C,110C 'request':48B,111C 'say':51B 'self':25B 'self-host':24B 'send':44B,106C 'sensit':60B 'siem':27B 'sourc':67B 'special':108C 'syslog':66B 'unauthent':30B,98C 'unauthor':65B 'vendor':28B,50B 'version':83C 'vulner':88C 'zohocorp':77C","nicknames":[],"mitigations":[],"who_affected":"Organizations running ManageEngine EventLog Analyzer or Log360 at build 13070 or earlier. The vendor does not say the flaw depends on a non-default setting, so treat every self-hosted install below 13071 as exposed, especially where the server is reachable from untrusted networks. Teams relying on these logs for detection or audit should also treat their log data as possibly tampered with.","tier":"B","verified":{"fix":{"at":"2026-11-03T08:20:38Z","by":"analyst","doc":"https://www.manageengine.com/log-management/release-notes.html","run_id":1467},"products":{"at":"2026-11-03T08:20:38Z","by":"analyst","doc":"https://www.manageengine.com/log-management/release-notes.html","run_id":1467},"how_to_check":{"at":"2026-11-03T08:20:38Z","by":"analyst","doc":"https://www.manageengine.com/log-management/release-notes.html","run_id":1467},"who_affected":{"at":"2026-11-03T08:20:38Z","by":"analyst","doc":"https://www.manageengine.com/log-management/release-notes.html","run_id":1467}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["analyzer","eventloganalyzer","log360"],"ptokens":["analyzer","eventlog","log360"],"labels":["eventloganalyzer","high","log360","manageengine","selfhosted","siem","vendor"],"first_public_at":"2026-11-03T08:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"0fc0942c-577d-436f-ae8e-945763c79b02","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-16900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-16900","severity":null,"published_at":"2026-11-03T08:17:15+00:00","modified_at":"2026-11-03T08:17:15+00:00","first_seen_at":"2026-11-03T08:19:30+00:00","fetched_at":"2026-11-03T08:19:30+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-16900:1467","url":null,"severity":null,"published_at":"2026-11-03T08:20:38+00:00","modified_at":"2026-11-03T08:20:38+00:00","first_seen_at":"2026-11-03T08:20:38+00:00","fetched_at":"2026-11-03T08:20:38+00:00","note":"Vendor advisory: affected builds 13070 and earlier, fixed 13071 (Aug 25 2026); NVD text says 13071 and below, which conflicts. Impact per vendor: impersonate local collector, read config data, add syslog sources to inject fake logs. No exploitation or PoC found; did not search social posts. Sibling CVE-2026-12263 and CVE-2026-92905 fixed in same build."}],"documents":[{"id":56479,"url":"https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html","title":"ManageEngine advisory CVE-2026-16900","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":56477,"url":"https://www.manageengine.com/log-management/release-notes.html","title":"Log360 release notes, build 13071","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}