{"id":"CVE-2026-13594","published":"2026-11-03T08:17:15.203","lastModified":"2026-11-03T08:17:15.203","description":"Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.","cvssScore":9.1,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-284"],"vendors":[],"products":[],"references":[{"url":"https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Zoho ManageEngine Log360 and EventLog Analyzer versions 13062 and below contain a vulnerability (CWE-284) that could allow unauthorized access due to improper access control enforcement.","exploitability":"Exploitation likely requires network-level access and no authentication, as indicated by CVSS vector AV:N/AC:L/PR:N/UI:N.","blast_radius":"Successful exploitation could lead to full compromise of confidentiality and integrity of the affected system, potentially exposing sensitive log data and enabling further lateral movement.","remediation":"Upgrade to version 13063 or later, as this is the first fixed version following the vulnerable 13062 release.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","log-management","webapp","sensitive-data-exposure"],"model":"garnet-coder","analyzedAt":"2026-11-03T09:57:04.430Z"}}