CVE-2026-16900

Full vulnerability record from the local CVENow database.

Description

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.

Severity

HIGH

CVSS score

7.5 (v3.1)

Vulnerability status

Received

Source identifier

0fc0942c-577d-436f-ae8e-945763c79b02

Published

2026-11-03 08:17:15.370000

Last modified

2026-11-03 08:17:15.370000

View original CVE JSON

{
  "id": "CVE-2026-16900",
  "sourceIdentifier": "0fc0942c-577d-436f-ae8e-945763c79b02",
  "published": "2026-11-03T08:17:15.370",
  "lastModified": "2026-11-03T08:17:15.370",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request."
    }
  ],
  "affected": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "affectedData": [
        {
          "vendor": "Zohocorp",
          "product": "Log360",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "13071",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Zohocorp",
          "product": "EventLog Analyzer",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0",
              "lessThan": "13071",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ]
  },
  "weaknesses": [
    {
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html",
      "source": "0fc0942c-577d-436f-ae8e-945763c79b02"
    }
  ]
}