ManageEngine Log360 CVE-2026-13594

Exploitation requires network access to a running ManageEngine Log360 or EventLog Analyzer instance at version 13062 or below; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication, no privileges, and no user interaction are needed against such an instance. The specific product feature, endpoint, or configuration that triggers the access-control bypass is not described in the available sources. The primary limiting factors are therefore version (≤13062) and network exposure of the management interface - instances not reachable from the attacker's network, or already updated beyond 13062, are not exploitable. No special non-default configuration is identified as required in the available data.

This is a genuinely high-priority issue rather than an inflated high-CVSS score. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N, base 9.1) describes a network-reachable, low-complexity flaw requiring no privileges and no user interaction, mapped to CWE-284 (Improper Access Control) and tagged as an Authentication Bypass - the combination that is most readily weaponized. The vuln.today decision label is act_now, which reinforces urgency. However, the exploitation signals partially conflict with that urgency: the input provides no EPSS probability, no CISA KEV listing, and no PoC/exploit reference, so there is no public exploit identified at time of analysis and no confirmation of active exploitation. In short, the urgency here derives from exploitability metrics and the sensitivity of the affected products (enterprise SIEM/log-management tooling), not from observed in-the-wild activity. EPSS and KEV data are missing from the input and should be checked directly before deprioritizing. Because the products store security logs and audit data, a confidentiality/integrity compromise (C:H/I:H) is especially consequential, warranting prompt patching despite the lack of confirmed exploitation.

A remote attacker with network reachability to an exposed ManageEngine Log360 or EventLog Analyzer instance (version 13062 or below) sends requests that bypass the product's access controls, obtaining unauthorized access without any credentials or user interaction. Given AV:N/AC:L/PR:N/UI:N, this requires only network access to the vulnerable service. No public exploit was identified at time of analysis, and the precise trigger is not described in the available sources.