ManageEngine product advisory calls the issue High.
CNA (Zohocorp) CVSS 3.1: 9.1 Critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N). CVE: CVE-2026-13594. Fixed build: 13062 (6 July 2026). KEV status: CVE-2026-13594 is not in CISA's Known Exploited Vulnerabilities Catalog (catalog version 2026.11.04).
ManageEngine has disclosed CVE-2026-13594, an improper access control flaw in Log360 and EventLog Analyzer that could let an adversary gain unauthorized access to the product. The fix, build 13062, has been available since 6 July 2026. The CVE is not in CISA's KEV catalog, and no exploitation has been reported. The reason to act now is the product's role: a SIEM holds logs and credentials from across the environment.
Technical Information
ManageEngine's advisory calls the issue High. The vendor says successful exploitation "could impact the confidentiality, integrity, and availability of the product" and that it was resolved "by strengthening the authentication checks in the affected components." The CVE record (CNA Zohocorp) classifies it as CWE-284 Improper Access Control and scores it CVSS 3.1 base 9.1 Critical with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N (availability impact None on the score, even though the product advisory mentions availability in its impact wording). NVD analysis is still pending and currently surfaces that same CNA score. CISA's SSVC enrichment lists exploitation as none, automatable as yes, and technical impact as total. No technical details or proof of concept have been published, and we do not speculate about them. The issue was reported through the Zoho BugBounty program.
Affected Product Versions
- ManageEngine Log360: builds 13025 to 13061
- ManageEngine EventLog Analyzer: builds 13025 to 13061
- Fixed: build 13062 and later
Note on the 13062 boundary: ManageEngine's advisory lists affected builds as 13025 to 13061 and fixed version 13062. The CVE record's affected-version data likewise uses lessThan 13062. The NVD and CVE description text still say "versions 13062 and below." This advisory follows the vendor advisory and the CVE affected-version data: build 13062 is the fix.
Workaround and Mitigation
- Update to build 13062 or later using the ManageEngine service pack. This is the only remediation ManageEngine lists.
- Until you patch, restrict network access to the web console so it is reachable only from admin networks or a VPN, and never directly from the internet. The network-restriction step is Rescana guidance for the period until you have patched, not a ManageEngine-published workaround.
- Review recent console logins and admin account changes.
- ManageEngine has published no workaround besides the update.
Indicators of Compromise
ManageEngine and CISA have not published any IOCs. We list none rather than invent them. As a sensible check, look for unexpected console sessions, new admin users, or configuration changes on instances that ran builds 13025–13061.
What to do with this vendor today (TPRM)
Managed security providers and IT outsourcers often run Log360 or EventLog Analyzer for you, holding your logs and service credentials. Today:
- Ask suppliers who provide SIEM or log-management services whether they run Log360 or EventLog Analyzer, and on which build.
- Ask them to confirm they are on build 13062 or later and that the console is not exposed to the internet.
- For any instance that ran an affected build while exposed, ask whether they have reviewed access logs.
Ask for dates and evidence rather than a yes. Our platform validates vendor claims against live attack-surface signal and chases findings to closure under your approval.
Need help working through SIEM and managed-security suppliers exposed to CVE-2026-13594? Our team can help you prioritize them and track their answers. Talk to an expert
Sources
- ManageEngine security advisory, CVE-2026-13594 — https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html
- CVE record, CVE-2026-13594 — https://www.cve.org/CVERecord?id=CVE-2026-13594
- NVD, CVE-2026-13594 — https://nvd.nist.gov/vuln/detail/CVE-2026-13594
- KEV status, checked 5 Nov 2026: CVE-2026-13594 is not in CISA's Known Exploited Vulnerabilities Catalog (catalog version 2026.11.04). Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
