# CVE-2026-92905: ZohoCorp ManageEngine EventLog Analyzer and Log360 DoS in log collector

Source: https://junglewise.ai/threats/cve-2026-92905-zohocorp-manageengine-eventlog-analyzer-and-log360-before-build  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92905 · Severity: medium · CVSS 5.3 · Published 2026-09-24

ManageEngine EventLog Analyzer and Log360 are log management and SIEM solutions that collect and analyze system logs from servers and network devices. A vulnerability in the syslog listener component allows unauthenticated attackers to crash the log collector service by sending malformed syslog packets, disrupting log collection and analysis until the service is restarted or patched.

Technologies: [Zohocorp ManageEngine Log360](https://junglewise.ai/threats/technologies/manageengine-log360). Vendors: [Zohocorp](https://junglewise.ai/threats/vendors/zohocorp).

## Quick answers

**Is CVE-2026-92905 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92905 being exploited in the wild.

**How severe is CVE-2026-92905?** Medium severity, with a CVSS score of 5.3, published 24 September 2026.

**Which products and versions are affected?** Zohocorp ManageEngine EventLog Analyzer before build 13071; Zohocorp ManageEngine Log360 before build 13071.

**Is there a fix for CVE-2026-92905?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92905 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-92905?** Check whether you run Zohocorp ManageEngine EventLog Analyzer or Zohocorp ManageEngine Log360 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The log collector component in EventLog Analyzer and Log360 fails to properly validate malformed syslog datagrams, allowing an unauthenticated attacker with network access to the syslog listener port to trigger an unhandled exception that crashes the service. The vulnerability is triggered by sending specially crafted syslog packets to the syslog listener, causing a denial of service. The fix improves input validation to safely discard malformed packets and allow the service to continue running.

## Affected products

- ZohoCorp ManageEngine EventLog Analyzer before build 13071
- ZohoCorp ManageEngine Log360 before build 13071

## Timeline

- 2026-08-25: other: Fix released in build 13071
- 2026-09-24: disclosed: Vulnerability publicly disclosed

## References

- [https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html](https://www.manageengine.com/log-management/advisory/CVE-2026-92905.html)

## Related threats

- [Zohocorp ManageEngine Eventlog Analyzer log forwarding remote code execution](https://junglewise.ai/threats/cve-2026-8923-zohocorp-manageengine-eventlog-analyzer-and-manageengine-log360)
- [Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions…](https://junglewise.ai/threats/cve-2026-3324-zohocorp-manageengine-log360-versions-13000-through-13013-are)