ManageEngine Log360 CVE-2026-16900

The exact prerequisite is network reachability of the local collector registration interface in ManageEngine Log360 or EventLog Analyzer running build 13071 or below; the flaw lets an unauthenticated actor register a local collector via a specially crafted registration request. Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, user interaction, or non-default configuration is documented as required, so exposure is limited primarily by whether the collector registration endpoint is network-accessible to the attacker and whether the deployment is on an affected version (≤13071); updating to a fixed build removes the condition. The description does not state how the registration authentication check is bypassed, so the precise trigger is not described in the available sources.

The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5) describes a network-reachable, low-complexity, unauthenticated flaw with confidentiality-only impact, which is consistent with the description of an authentication bypass in local collector registration. The vuln.today decision label is 'this_week', indicating elevated but not emergency urgency. No EPSS score is provided, this CVE is not listed in CISA KEV, and no public exploit or PoC reference is present in the input, so there is no public exploit identified at time of analysis. The signals are internally consistent rather than conflicting: a genuinely unauthenticated bypass in a security/SIEM product is a meaningful priority, but the absence of KEV, EPSS, and any PoC means there is no evidence of active or widespread exploitation yet. The confidentiality-only impact (I:N/A:N) tempers the raw severity - the documented outcome is unauthorized registration of a collector rather than code execution or data destruction. Net: a credible this-week patching priority for affected ManageEngine deployments, not a confirmed in-the-wild emergency; missing EPSS data limits precise probability estimation.

A remote, unauthenticated attacker who can reach the EventLog Analyzer/Log360 local collector registration interface sends a specially crafted registration request and registers a local collector without valid credentials. Because the CVSS vector is AV:N/AC:L/PR:N/UI:N, no authentication, user interaction, or special timing is required beyond network reachability of the vulnerable endpoint. No public exploit or PoC reference is present in the input, so this scenario is inferred from the description and CVSS vector rather than demonstrated exploit code.