---
id: CVE-2026-16900
title: Authentication Bypass
summary: >-
  Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below
  are vulnerable to an authentication bypass in local collector registration,
  allowing unauthenticated actor to register a local collector by sending a
  specially c…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-284
vendor: Zohocorp
product: Log360
affected:
  - Log360 < 13071
  - eventlog_analyzer < 13071
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-11-03T20:07:14.394547Z'
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T20:07:31.430Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-16900'
references:
  - url: >-
      https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html
tags:
  - cve.org
epss: 0.01539
epssPercentile: 0.75053
ingestedAt: '2026-11-05T20:33:06.431Z'
---

## Overview

Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below are vulnerable to an authentication bypass in local collector registration, allowing unauthenticated actor to register a local collector by sending a specially crafted registration request.

## Affected

- `Log360 < 13071`
- `eventlog_analyzer < 13071`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.