Zohocorp ManageEngine Eventlog Analyzer and Log360: Authenticated remote code execution (CVE-2026-8923)
ManageEngine Eventlog Analyzer and Log360 versions prior to 13062 contain an authenticated remote code execution vulnerability in the log forwarding feature.
CVE search metadata
CVE search record: CVE-2026-8923. Severity: high. CVSS: 8.7. KEV: no. Product: ManageEngine Eventlog Analyzer (< 13062), ManageEngine Log360 (< 13062). Brief: Zohocorp ManageEngine Eventlog Analyzer and Log360: Authenticated remote code execution (CVE-2026-8923). Brief link: https://feed.craftedsignal.io/briefs/2026-11-manageengine-rce/
Triage facts
Revision 1- Applicability
- ManageEngine Eventlog Analyzer (< 13062), ManageEngine Log360 (< 13062)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Nov 2, 11:29 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to authenticated remote code execution (RCE) via the Log Forwarding configuration option. An attacker with valid credentials can leverage this feature to execute arbitrary code on the underlying host system.
Impact
Successful exploitation allows an authenticated user to achieve remote code execution on the server hosting the ManageEngine application, potentially leading to full system compromise.
Recommendation
- Upgrade ManageEngine Eventlog Analyzer and ManageEngine Log360 to version 13062 or later immediately.
- Audit existing ManageEngine administrative accounts and restrict access to the Log Forwarding configuration interface to verified administrators only.
- Review historical logs for any unusual modifications to log forwarding settings or suspicious process execution spawning from the ManageEngine service account.
Immediate actions
Upgrade ManageEngine Eventlog Analyzer and Log360 to 13062 or later
Threat Hunt
Identify unusual process creation initiated by ManageEngine service accounts
Data: Process creation logs (EID 1 / Audit Process Creation)
Mitigations
Upgrade to 13062
CVE-2026-8923