Introduction
An improper access control flaw in ManageEngine Log360 and EventLog Analyzer could let an adversary with network access gain unauthorized access to the product without credentials or user interaction, according to the vendor's own CVSS assessment. These products collect logs and support security monitoring and auditing, so unauthorized access to them matters to the teams that depend on that visibility. No downstream compromise has been documented for this CVE.
ManageEngine is the enterprise IT management division of Zoho Corporation. Log360 is its SIEM offering for centralized log collection, analysis, investigations, and automated response. EventLog Analyzer collects and analyzes logs for security event monitoring and auditing. ManageEngine reports that more than 180,000 companies use its products and that 9 of every 10 Fortune 100 organizations rely on its IT management tools. These are vendor-supplied portfolio figures, not counts of vulnerable installations. Security tooling of this kind typically has broad visibility into an organization's infrastructure, which is why access control weaknesses in it draw attention.
ManageEngine, acting as the CNA, scored CVE-2026-13594 at CVSS 3.1 9.1 (Critical). The fix shipped in build 13062 on July 6, 2026, roughly four months before NVD published the CVE on November 3, 2026. In this post we summarize what is publicly known, what is not, and how to apply the fix.
Technical information
Root cause
NVD classifies the weakness as CWE 284, Improper Access Control. The vendor advisory gives a single sentence on root cause: the issue "has been resolved by strengthening the authentication checks in the affected components."
Read together with the CWE label, this tells us:
- Before the fix, at least one component did not properly enforce authentication before allowing access to protected functionality.
- The fix adds or tightens authentication checks in those components, so a request must pass authentication before reaching protected functionality.
- ManageEngine has not said which components or endpoints were changed.
Both products are closed source. There is no public commit, diff, or code snippet to inspect, and the advisory does not disclose an affected endpoint, parameter, request format, payload, session manipulation technique, or reproducible exploitation procedure. We therefore cannot describe the vulnerable code path, and we have not attempted to reconstruct one.
CVSS assessment
The CNA-supplied vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. This is ManageEngine's score, not an independent NIST assessment.
- Attack Vector: Network
- Attack Complexity: Low (no specialized conditions required)
- Privileges Required: None (no prior account or privilege needed)
- User Interaction: None (no victim action required)
- Scope: Unchanged
- Confidentiality: High
- Integrity: High
- Availability: None
The vector assigns no availability impact, while the vendor advisory describes possible effects on confidentiality, integrity, and availability. Neither source describes an observed attack, so we treat the vector as an assessment of exploitability and impact rather than a documented outcome. Neither the advisory nor NVD establishes remote code execution, operating system privilege escalation, or a particular data extraction method for this CVE. The supported outcome is unauthorized access to the product.
Attack flow, as far as public information allows
Based only on the vector and the vendor's root-cause statement, the exploitation path looks like this:
- The attacker needs network reachability to the web-facing components of a Log360 or EventLog Analyzer instance running an affected build (13025 through 13061 per the vendor).
- The attacker does not need credentials or prior privileges, and no administrator or user has to take any action.
- The attacker sends requests that reach functionality in an affected component where authentication was not properly enforced. Which component, endpoint, or request shape is involved has not been disclosed.
- The result is unauthorized access to the product, assessed as high impact to confidentiality and integrity.
Possible chaining with other 13062 fixes
Build 13062 also patched two authenticated remote code execution bugs:
- CVE-2026-2740, in the remote agent installation workflow.
- CVE-2026-8923, affecting users with log forwarding and log filtering privileges.
An access control bypass that removes the authentication requirement could plausibly be chained with those post-authentication flaws. This is an inference from the release contents, and no source documents such a chain being demonstrated. It is still a good reason to treat the whole release as a single upgrade rather than evaluating each CVE in isolation.
Exploitation status
The reviewed vendor and NVD sources do not establish active exploitation, name a campaign, or identify a threat actor. We found no CVE-specific public proof of concept, malware association, or indicators of compromise. The credited researcher, tran nghia, reported the issue through the Zoho BugBounty program and should not be confused with an attacker.
The CISA Known Exploited Vulnerabilities feed available to us is version 2026.10.30, released October 30, 2026, which predates this CVE's NVD publication. That feed cannot tell us whether the CVE has since been added, so current KEV inclusion is not established here.
Patch information
Where the fix lives
ManageEngine fixed CVE-2026-13594 in build 13062 of Log360 and EventLog Analyzer (EventLog Analyzer 13.0.6), released July 6, 2026. Both products' release notes for build 13062 list the CVE under Security Issue Fixes, describing it as a flaw "that could allow an adversary to gain unauthorized access to the product." No diff is published, so defenders cannot confirm the fix by inspecting code. The only reliable check is the product's build number.
Versions after 13062
- Build 13063 (July 20, 2026) did not change the security fix. It addressed a problem with service pack upgrades that occurred when more than one service pack was applied at once without restarting the product between upgrades.
- The current EventLog Analyzer service pack is 13.0.7 (Build 13073). Its download page offers it to any build from 13000 to 13072 and says to restart the service before applying it, or the update may fail.
- Any build of 13062 or higher includes the fix.
How to apply it
The fix ships as a .ppm service pack installed with the bundled Update Manager. The vendor's EventLog Analyzer documentation describes the following process:
- Check the installed build. In the web client, select the question mark icon, then About.
- Download the PPM file or files that match your current build. Installations several builds behind may need staged upgrades.
- Back up the installation. The vendor describes this step as mandatory: stop the service and copy the complete installation folder or take a server snapshot. If you use Microsoft SQL Server, take a database snapshot as well. Confirm there is enough disk space.
- Install the service pack with Update Manager.
On Windows, stop the service, then run:
shutdown.bat stopDB.bat stopSEC.bat UpdateManager.bat
Then select the PPM file in Update Manager.
On Linux, run:
UpdateManager.sh
On Linux systems without a GUI, the vendor instructs adding the c option (a dash followed by c) to the command.
- Start the product and confirm that the build number shows 13062 or later. When applying multiple service packs, start the application after each one.
For Distributed Edition, apply the service pack only to the admin server. It automatically upgrades the reporting managed servers, which then update agents where used.
These detailed steps come from EventLog Analyzer documentation. The CVE advisory covers both products but does not supply an equally detailed Log360 procedure. The advisory also documents no alternative workaround: no CVE-specific firewall rules, detection signatures, cleanup scripts, or credential rotation guidance. For unresolved questions, ManageEngine publishes [email protected] and its vulnerability reporting portal.
Affected systems and versions
- Products: ManageEngine Log360 and ManageEngine EventLog Analyzer (Zoho Corporation; NVD's vendor field of "Unknown" is inaccurate).
- Affected builds (vendor advisory): 13025 through 13061.
- First fixed build: 13062 (EventLog Analyzer 13.0.6), released July 6, 2026.
- Later builds: 13063 (July 20, 2026) and EventLog Analyzer 13.0.7 (Build 13073) both include the fix.
The version range discrepancy
The NVD description says versions "13062 and below" are vulnerable. That conflicts with:
- The vendor advisory, which names 13062 as fixed.
- Both products' release notes, which list the CVE as fixed in 13062.
- NVD's own affected products entry, which gives the range as
0 < 13062.
The "and below" wording looks like an off-by-one error in the CVE text. Teams whose scanners key off the NVD description may see hosts on 13062 incorrectly flagged. The vendor's guidance is unambiguous that 13062 is the first fixed build, and upgrading to the latest build (13073) sidesteps the ambiguity entirely. The vendor also lists 13025 as the lower bound of the affected range, while NVD's product entry sets no lower bound. The remediation is the same either way.
Vendor security history
The ManageEngine Security Response Center (MESRC) states that it monitors, identifies, investigates, resolves, and responds to product vulnerabilities. It accepts researcher submissions through Zoho's bug bounty portal, validates reports through product experts, and distributes remedies as service packs or patches. The credited bug bounty report and the documented fix to authentication checks for this CVE are consistent with that process. The sources do not disclose the original report date, so response time cannot be calculated.
ManageEngine also has a documented history of serious exploitation in other products. CISA reported that as early as January 2023, nation-state APT actors exploited CVE-2022-47966 in a public-facing ManageEngine ServiceDesk Plus instance. They gained root-level access, collected administrative credentials, and moved laterally.
That incident involved a different product and a different vulnerability. It shows that ManageEngine products have been targeted, but it is not evidence that CVE-2026-13594 shares its mechanism, impact, victims, or operators.
References
- NVD entry for CVE-2026-13594
- ManageEngine advisory: CVE-2026-13594 Improper Access Control in Log360 and EventLog Analyzer
- EventLog Analyzer readme
- Log360 readme
- EventLog Analyzer service packs and upgrade instructions
- EventLog Analyzer latest features and release notes
- Log360 release notes
- How to upgrade EventLog Analyzer to the latest build on Windows
- ManageEngine Security Response Center
- ManageEngine About Us
- ManageEngine EventLog Analyzer product page
- ManageEngine Log360 product page
- CISA Known Exploited Vulnerabilities Catalog
- CISA KEV JSON feed
- CISA advisory: Multiple Nation State Threat Actors Exploit CVE-2022-47966 and CVE-2022-42475
