Missing authentication in ManageEngine Log360
Priority MEDIUM 55CWE-306Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-306.
Summary
ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup.
Why it matters now
EPSS 0.10787 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed ManageEngine Log360: 5235
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | ManageEngine Log360 | before 5235 | 5235 | Patch available | CNA |
- ManageEngine Log360 Vendor— Affected before 5235 Fixed in 5235 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_log360:*:*:*:*:*:*:*:* | up to 5.2 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5232:*:*:*:*:*:* | 5.3 build5232 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5233:*:*:*:*:*:* | 5.3 build5233 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5234:*:*:*:*:*:* | 5.3 build5234 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_log360:*:*:*:*:*:*:*:* Versions up to 5.2 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5232:*:*:*:*:*:* Versions 5.3 build5232 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5233:*:*:*:*:*:* Versions 5.3 build5233 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_log360:5.3:build5234:*:*:*:*:*:* Versions 5.3 build5234 Vulnerable ·Zohocorp
Remediation
- Fix · CNA ManageEngine Log360 Fixed in 5235
Timeline
- 2026-10-02 Threatist record created from CVE-2021-20136
- 2026-10-03 Alias added: GHSA-3fq5-562h-h369
References
More Zohocorp Manageengine Log360 vulnerabilities
- TI-2020-15194 An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number… CVSS 3.1CRITICAL 9.8
- TI-2021-17355 Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution. CVSS 3.1CRITICAL 9.8
- TI-2021-17357 Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite. CVSS 3.1CRITICAL 9.8
- TI-2026-02867 Authentication bypass in Zohocorp ManageEngine Log360 CVSS 3.1HIGH 8.2
- TI-2023-17875 Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and… CVSS 3.1HIGH 8.1
- TI-2021-17354 Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings. CVSS 3.1HIGH 8.8
Sources
- CVE-2021-20136 · CVE Program
- CVE-2021-20136 · NVD
- FIRST EPSS
- GHSA-3fq5-562h-h369 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences