EUVD-2026-23247
GHSA-6q34-632f-jr72
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-reachable Log360 console
-
DeliverySend crafted request to unfiltered action endpoint
-
ExploitBypass authentication via alternate path
-
ExecutionInvoke privileged action or read sensitive data
-
ImpactExfiltrate aggregated log/SIEM data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Alternate path authentication
|
| Exploitation Conditions | Exploitation requires network reachability to the ManageEngine Log360 web console (builds 13000-13013) and targeting the specific 'certain actions' whose endpoints fall outside the improperly configured authentication filter; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special privileges are needed against a default deployment. The principal limiting factors are: only a subset of actions are exposed (not the entire application), the affected version window is narrow (13000 through 13013 only, so older/newer builds are out of scope), and the impact is bounded to high confidentiality with only low integrity and no availability effect - meaning a successful attacker reads data or performs limited actions rather than fully compromising the host. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes a low-complexity, network-reachable, unauthenticated bypass, which normally warrants urgent patching, and the 8.2 score with C:H reflects meaningful data exposure. However, the corroborating exploitation signals are softer: EPSS is only 0.14% (35th percentile), CISA SSVC records Exploitation as 'none' and Technical Impact as only 'partial', and there is no KEV listing or known POC. The one amplifying signal is SSVC 'Automatable: yes', meaning the reconnaissance-through-exploitation steps can be scripted at scale if a working technique emerges. Net assessment: a genuine priority patch for internet-exposed or widely-accessible Log360 consoles given the unauthenticated network vector, but current real-world exploitation appears low/absent - treat as 'patch promptly' rather than 'emergency in-the-wild' until an exploit surfaces. Note the integrity rating is only Low (I:L) and Availability is None, so this is primarily an information-disclosure/unauthorized-action risk, not full compromise, per the provided vector. |
| Exploit ScenarioDerived | An attacker who can reach the Log360 web interface sends a crafted HTTP request directly to one of the action endpoints that the misconfigured filter fails to protect, invoking it without logging in and retrieving sensitive SIEM/log data or triggering a privileged action. Because the CVSS vector is unauthenticated and low-complexity, no credentials or user interaction are needed; SSVC marks the technique as automatable, so it could be scripted across many hosts, though no public POC is currently known. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 24, 2026
Authentication bypass in Zohocorp ManageEngine Log360 (builds 13000 through 13013) lets remote unauthenticated attackers reach certain protected actions because of an improper request-filter configuration, exposing high-confidentiality data with limited integrity impact (CVSS 8.2). No public exploit is identified at time of analysis and EPSS is low (0.14%), but CISA's SSVC flags the flaw as automatable, so opportunistic scanning is plausible once details spread. Log360 is an enterprise SIEM/log-management console, making any auth bypass on it a high-value target for attackers seeking to blind defenders or harvest aggregated log data.
RemediationAI
Apply the fix described in ManageEngine's advisory at https://www.manageengine.com/log-management/advisory/CVE-2026-3324.html; the affected range ends at build 13013, so upgrade to the next vendor-released build above 13013, but the exact patched version number was not present in the provided data and should be confirmed from that advisory before deployment. Patch available per vendor advisory - no exact fix version was independently verifiable from the input. As a compensating control until patched, restrict network access to the Log360 web console by placing it behind a VPN or firewall allow-list so it is not internet-facing (trade-off: remote admins must connect through the VPN), and if a WAF fronts the console, add rules blocking direct requests to the unauthenticated action endpoints once the vendor identifies them (trade-off: overly broad rules may break legitimate integrations). Review console access logs for anomalous requests to sensitive actions from unauthenticated sessions as a detection measure.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Log360 is ManageEngine's unified SIEM platform that aggregates Active Directory auditing, log management, and threat detection through a Java-based web console. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel): a misconfigured request/servlet filter fails to apply authentication checks to specific endpoints or action paths, so an attacker can invoke those actions through an unguarded route rather than the normal authenticated flow. Because the weakness is in filter coverage rather than credential validation itself, only 'certain actions' are exposed - the endpoints that fall outside the filter's URL/method matching - which is consistent with the CVSS partial (C:H/I:L) impact profile.
Know when Manageengine Log360 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Filter misconfiguration allows unauthenticated network access to protected actions (PR:N/AV:N/AC:L); only certain actions are exposed yielding high confidentiality but limited integrity and no availability impact.
Primary rating from Vendor (0fc0942c-577d-436f-ae8e-945763c79b02).
CVSS VectorVendor: 0fc0942c-577d-436f-ae8e-945763c79b02
DescriptionCVE.org
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
Executive ViewAI
ManageEngine Log360, a critical enterprise SIEM platform, contains an authentication bypass vulnerability (CVE-2026-3324, CVSS 8.2) affecting builds 13000-13013 that allows unauthenticated remote attackers to access protected functions and exfiltrate high-value log data. This vulnerability directly undermines your ability to investigate incidents, maintain audit compliance, and detect ongoing attacks-leaving your security operations exposed to adversaries seeking to blind your defenses during critical incident response.
No vendor-released patch identified at time of analysis. Interim mitigations include strict network segmentation and IP whitelisting to restrict Log360 access to trusted administrative networks, enhanced logging and alerting on all access attempts to detect exploitation, disabling unnecessary remote access capabilities, and maintaining isolated backups of critical logs. Given CISA SSVC flags this as automatable, prioritize network-based detection and blocking.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Manageengine Log360
View allManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configurati
Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite. Rated critical severity
Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution. Rated c
An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number
Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings. Rated high se
Zoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings. Rated high severity (CVSS 8.8), this
Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and bel
Zoho ManageEngine Log360 before Build 5224 allows stored XSS via the LOGO_PATH key value in the logon settings. Rated me
Zoho ManageEngine Log360 before Build 5225 allows stored XSS. Rated medium severity (CVSS 6.1), this vulnerability is re
Malformed syslog packets can crash the log collector in ManageEngine EventLog Analyzer and Log360 builds prior to 13071,
Exploit-DB