CVE-2026-16900: Authentication Bypass

Published Nov 3, 2026

Updated

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.

Event History

Nov 3, 2026

CVE Published

via MITRE·07:39 AM

Data Sourced

via MITRE·07:39 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

ManageEngine Log360 and EventLog Analyzer versions 13071 and below are affected.

What does an attacker need to exploit this issue?

An unauthenticated attacker can exploit the issue by sending a specially crafted local collector registration request. No privileges or user interaction are required according to the provided vector.

What could an attacker do after exploitation?

The attacker can register a local collector without authentication. The provided data does not specify any further actions or impact beyond unauthorized collector registration.

CVE-2026-16900: Authentication Bypass

Event History

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What could an attacker do after exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does an attacker need to exploit this issue?

What could an attacker do after exploitation?