CVE-2026-8923: OS Command Injection
Published Nov 2, 2026
·Updated
Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.
Event History
Nov 2, 2026
CVE Published
via NVD·11:17 AM
Data Sourced
via NVD·11:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are affected.
2
What level of access does an attacker need?
An attacker must already be authenticated and have high privileges. Exploitation does not require user interaction and can be performed remotely over the network.
3
What functionality is involved in exploitation?
The vulnerability is in the Log Forward option and is classified as OS command injection, allowing authenticated remote code execution.
4
What is the remediation target?
Upgrade affected ManageEngine Eventlog Analyzer or ManageEngine Log360 installations to version 13062 or later.