{"id":"CVE-2026-8923","published":"2026-11-02T11:17:33.380","lastModified":"2026-11-03T05:18:53.573","description":"Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.","cvssScore":8.7,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://www.manageengine.com/products/eventlog/advisory/CVE-2026-8923.html","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Authenticated users with elevated privileges can inject OS commands into the Log Forward feature of Zoho ManageEngine Eventlog Analyzer and Log360 versions before 13062, leading to remote code execution on the server.","exploitability":"Exploitation requires valid credentials with high-privilege access (PR:H) and no user interaction (UI:N), making it feasible for compromised admin accounts but not for anonymous attackers.","blast_radius":"Successful exploitation allows full compromise of confidentiality and integrity on the affected server, potentially enabling lateral movement or data exfiltration from security logs.","remediation":"Upgrade to version 13062 or later, which contains the vendor's fix for the authenticated RCE vulnerability in the Log Forward functionality.","detection":"Monitor for unusual outbound network connections or unexpected child process spawns (e.g., cmd.exe, bash, powershell) initiated by the Eventlog Analyzer service account; inspect application logs for malformed or injected command strings in Log Forward configuration entries.","tags":["rce","authenticated","webapp","command-injection","log-management"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:00:03.865Z"}}