ManageEngine EventLog Analyzer CVE-2026-8923

Exploitation requires an authenticated, high-privilege account on ManageEngine EventLog Analyzer or Log360 (reflected by PR:H) with access to the 'Log Forward' configuration option, which is the specific feature that permits OS command injection (CWE-78). The vulnerability is network-reachable with no user interaction, so once an attacker holds the required privileged access it can be triggered remotely over the management interface. Limiting factors: the attacker must first obtain admin-level credentials or a valid privileged session, and only versions before 13062 are affected; the precise injectable input within the Log Forward feature is not described in the available sources.

This is a genuine but conditional priority rather than a drop-everything emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N, base 8.7) shows network reachability and low attack complexity, but PR:H means the attacker must already hold high privileges in the application - this is the single most important risk-limiting signal and it keeps the realistic threat to insiders or post-compromise attackers who have obtained admin-level credentials/session. The vuln.today decision label is 'this_week', consistent with a serious authenticated RCE that is not under active exploitation. No EPSS score was supplied, there is no CISA KEV listing, and no proof-of-concept or exploit reference is present (only the vendor advisory), so by the precision rules the status is 'no public exploit identified at time of analysis'. CWE-78 (OS command injection) plus the 'Command Injection'/'RCE' tags align with command execution on the host, which makes the impact severe once the privilege prerequisite is met. Note one internal inconsistency to verify: the supplied vector sets A:N (no availability impact), which is unusual for OS command execution that typically yields full host compromise including availability - this likely understates availability impact and should be confirmed against the vendor advisory. Overall: patch within the vendor/priority window, but the PR:H barrier means this is not comparable to an unauthenticated internet-facing RCE.

An attacker who already has a privileged (administrative) account or hijacked admin session on ManageEngine EventLog Analyzer or Log360 abuses the Log Forward configuration option to inject operating-system commands, achieving remote code execution on the underlying server. Because these are centralized SIEM/log-management platforms, host compromise exposes collected logs from across the monitored environment. No public exploit code is identified at time of analysis, and exploitation requires the high-privilege authentication reflected by PR:H.