What is the CVSS score of CVE-2026-3324?

CVE-2026-3324 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of ManageEngine Log360 are affected by CVE-2026-3324?

ManageEngine Log360, a critical enterprise SIEM platform, contains an authentication bypass vulnerability (CVE-2026-3324, CVSS 8.2) affecting builds 13000-13013 that allows unauthenticated remote…

How to fix or mitigate CVE-2026-3324?

Within 24 hours, execute an inventory scan to locate all Log360 instances in builds 13000-13013; immediately restrict network access to administrative IP ranges only and isolate any internet-facing instances from production. Within 7 days, deploy compensating controls: implement network segmentation blocking unauthenticated Log360 access, enable detailed access logging and alerting for all connection attempts, and request your security vendor publish IPS/WAF detection signatures for this CVE. Within 30 days, contact ManageEngine for the patch release timeline for builds 13000-13013; plan an upgrade path to a patched build or evaluate replacement SIEM solutions, and conduct a forensic audit of Log360 logs and data exports to identify unauthorized access during the vulnerability window.

ManageEngine Log360 CVE-2026-3324

EUVD-2026-23247 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-04-16 0fc0942c-577d-436f-ae8e-945763c79b02

GHSA-6q34-632f-jr72

Authentication Bypass Zoho Manageengine Log360 Zohocorp

8.2

CVSS 3.1 · Vendor: 0fc0942c-577d-436f-ae8e-945763c79b02

Severity by source

Vendor (0fc0942c-577d-436f-ae8e-945763c79b02) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Filter misconfiguration allows unauthenticated network access to protected actions (PR:N/AV:N/AC:L); only certain actions are exposed yielding high confidentiality but limited integrity and no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (0fc0942c-577d-436f-ae8e-945763c79b02).

CVSS VectorVendor: 0fc0942c-577d-436f-ae8e-945763c79b02

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 07:34 vuln.today

EUVD ID Assigned

Apr 16, 2026 - 15:22 euvd

EUVD-2026-23247

CVE Published

Apr 16, 2026 - 15:17 nvd

HIGH 8.2

DescriptionCVE.org

Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.

AnalysisAI

Authentication bypass in Zohocorp ManageEngine Log360 (builds 13000 through 13013) lets remote unauthenticated attackers reach certain protected actions because of an improper request-filter configuration, exposing high-confidentiality data with limited integrity impact (CVSS 8.2). No public exploit is identified at time of analysis and EPSS is low (0.14%), but CISA's SSVC flags the flaw as automatable, so opportunistic scanning is plausible once details spread. Log360 is an enterprise SIEM/log-management console, making any auth bypass on it a high-value target for attackers seeking to blind defenders or harvest aggregated log data.

Technical ContextAI

Log360 is ManageEngine's unified SIEM platform that aggregates Active Directory auditing, log management, and threat detection through a Java-based web console. The root cause is CWE-288 (Authentication Bypass Using an Alternate Path or Channel): a misconfigured request/servlet filter fails to apply authentication checks to specific endpoints or action paths, so an attacker can invoke those actions through an unguarded route rather than the normal authenticated flow. Because the weakness is in filter coverage rather than credential validation itself, only 'certain actions' are exposed - the endpoints that fall outside the filter's URL/method matching - which is consistent with the CVSS partial (C:H/I:L) impact profile.

RemediationAI

Apply the fix described in ManageEngine's advisory at https://www.manageengine.com/log-management/advisory/CVE-2026-3324.html; the affected range ends at build 13013, so upgrade to the next vendor-released build above 13013, but the exact patched version number was not present in the provided data and should be confirmed from that advisory before deployment. Patch available per vendor advisory - no exact fix version was independently verifiable from the input. As a compensating control until patched, restrict network access to the Log360 web console by placing it behind a VPN or firewall allow-list so it is not internet-facing (trade-off: remote admins must connect through the VPN), and if a WAF fronts the console, add rules blocking direct requests to the unauthenticated action endpoints once the vendor identifies them (trade-off: overly broad rules may break legitimate integrations). Review console access logs for anomalous requests to sensitive actions from unauthenticated sessions as a detection measure.