---
id: "CVE-2026-16900"
kind: "vulnerability"
aliases: ["CVE-2026-16900"]
title: "ManageEngine Log360 and EventLog Analyzer: collector registration bypasses authentication"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "EventLog Analyzer", "fixed": ["13071"], "affected": "<= 13070", "ecosystem": "vendor"}, {"name": "Log360", "fixed": ["13071"], "affected": "<= 13070", "ecosystem": "vendor"}]
ecosystems: []
tags: ["eventlog-analyzer", "log360", "manageengine", "self-hosted", "siem", "vendor"]
not_affected_if: ["build-13071-or-later", "unknown"]
published_at: "2026-11-03T08:17:15+00:00"
first_seen_at: "2026-11-03T08:19:30+00:00"
updated_at: "2026-11-03T08:20:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16900", "first_seen_at": "2026-11-03T08:19:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T08:20:38+00:00"}]
---

# ManageEngine Log360 and EventLog Analyzer: collector registration bypasses authentication

An unauthenticated attacker can register as a local collector in EventLog Analyzer and Log360 by sending a crafted registration request. The vendor says this lets them impersonate a local collector, read sensitive configuration data and add unauthorized syslog sources to inject fabricated log data. Fixed in build 13071.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EventLog Analyzer affected <= 13070 fixed 13071
- vendor:Log360 affected <= 13070 fixed 13071

## How to check

Check the installed build of Log360 or EventLog Analyzer. Builds 13070 and earlier are affected per the vendor; 13071 is fixed. (NVD says '13071 and below', but the vendor advisory and release notes name 13071 as the fixed build.) Also check whether the web console is reachable from untrusted networks, and review syslog sources and collector registrations for entries you did not add.

## Fix

Update EventLog Analyzer or Log360 to build 13071 or later (released Aug 25, 2026); vendor service-pack pages: https://www.manageengine.com/products/eventlog/service-packs.html and https://www.manageengine.com/log-management/service-packs.html

## Timeline

- 2026-11-03T08:19:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-16900
- 2026-11-03T08:20:38+00:00 analyst — Vendor advisory: affected builds 13070 and earlier, fixed 13071 (Aug 25 2026); NVD text says 13071 and below, which conflicts. Impact per vendor: impersonate local collector, read config data, add syslog sources to inject fake logs. No exploitation or PoC found; did not search social posts. Sibling CVE-2026-12263 and CVE-2026-92905 fixed in same build.

## Documents

- [advisory] ManageEngine advisory CVE-2026-16900 https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html
- [fix] Log360 release notes, build 13071 https://www.manageengine.com/log-management/release-notes.html

## From the sources

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_