CVE-2026-13594 Improper Access Control vulnerability

CriticalCVSS 9.1 EPSS 1.1%

Published: 2026-11-03 09:29
Updated: 2026-11-04 07:18
Exploit status: No public exploit known

Description

Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

Affected products

Product	Affected versions	Fixed in
Zohocorp Log360	< 13062	13062
Zohocorp EventLog Analyzer	< 13062	13062

References

www.manageengine.com

CVSS v3.1

9.1 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

All scores (2)

v3.1 9.1 · zohocorp
v3.1 9.1 · 0fc0942c-577d-436f-ae8e-945763c79b02

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.14% (percentile 67.1)
CWE: CWE-284 Improper Access Control

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.