# CVE-2026-16900: Zoho ManageEngine EventLog Analyzer and Log360 authentication bypass in collector registration

Source: https://junglewise.ai/threats/cve-2026-16900-zohocorp-manageengine-log360-and-eventlog-analyzer-versions-13071  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-03. Updated: 2026-11-03  
License: CC BY 4.0 with a link back

CVE-2026-16900 · Severity: high · CVSS 7.5 · Published 2026-11-03

Zoho ManageEngine EventLog Analyzer and Log360 are security information and event management (SIEM) platforms used to collect and analyze logs from IT infrastructure. An unauthenticated attacker can bypass authentication during local collector registration, allowing them to impersonate a legitimate collector, gain access to sensitive configuration data, and inject false logs into the system to cover tracks or trigger false alerts.

Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-16900 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16900 being exploited in the wild.

**How severe is CVE-2026-16900?** High severity, with a CVSS score of 7.5, published 3 November 2026.

**Which products and versions are affected?** Zoho ManageEngine EventLog Analyzer Build 13070 and earlier; Zoho ManageEngine Log360 Build 13070 and earlier.

**Is there a fix for CVE-2026-16900?** Yes: fixed in EventLog Analyzer Build 13071, Log360 Build 13071. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16900 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-16900?** Check whether you run Zoho ManageEngine EventLog Analyzer or Zoho ManageEngine Log360 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in EventLog Analyzer Build 13071, Log360 Build 13071

## Technical details

An authentication bypass vulnerability exists in the local collector registration mechanism that fails to properly validate registration requests. An unauthenticated attacker can send a crafted registration request to register a malicious local collector without credentials, gaining the ability to impersonate the collector and access configuration data or inject unauthorized syslog sources. The vulnerability is exploitable remotely over the network without prior authentication or user interaction.

## Affected products

- Zoho ManageEngine EventLog Analyzer Build 13070 and earlier
- Zoho ManageEngine Log360 Build 13070 and earlier

## Timeline

- 2026-11-03: advisory
- 2026-08-25: patched

## References

- [https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html](https://www.manageengine.com/products/eventlog/advisory/CVE-2026-16900.html)