Read the docs
TI-2021-17354 Aliases CVE-2021-40174GHSA-m3q4-2h86-cx2h

Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.

Priority MEDIUM 40CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Zoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.

Why it matters now

EPSS 0.00994 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_log360:*:*:*:*:*:*:*:*up to 5.1VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5200:*:*:*:*:*:*5.2 build5200VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5201:*:*:*:*:*:*5.2 build5201VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5206:*:*:*:*:*:*5.2 build5206VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5209:*:*:*:*:*:*5.2 build5209VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5210:*:*:*:*:*:*5.2 build5210VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5211:*:*:*:*:*:*5.2 build5211VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5213:*:*:*:*:*:*5.2 build5213VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5214:*:*:*:*:*:*5.2 build5214VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5218:*:*:*:*:*:*5.2 build5218VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:*:*:*:*:*:*:*:* Versions up to 5.1 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5200:*:*:*:*:*:* Versions 5.2 build5200 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5201:*:*:*:*:*:* Versions 5.2 build5201 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5206:*:*:*:*:*:* Versions 5.2 build5206 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5209:*:*:*:*:*:* Versions 5.2 build5209 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5210:*:*:*:*:*:* Versions 5.2 build5210 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5211:*:*:*:*:*:* Versions 5.2 build5211 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5213:*:*:*:*:*:* Versions 5.2 build5213 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5214:*:*:*:*:*:* Versions 5.2 build5214 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5218:*:*:*:*:*:* Versions 5.2 build5218 Vulnerable ·Zohocorp
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5219:*:*:*:*:*:*5.2 build5219VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5220_beta:*:*:*:*:*:*5.2 build5220_betaVulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5219:*:*:*:*:*:* Versions 5.2 build5219 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_log360:5.2:build5220_beta:*:*:*:*:*:* Versions 5.2 build5220_beta Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-40174
  2. 2026-10-03 Alias added: GHSA-m3q4-2h86-cx2h

References

Advisory 1

  • TI-2020-15194 An issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number… CVSS 3.1CRITICAL 9.8
  • TI-2021-03436 Missing authentication in ManageEngine Log360 CVSS 3.1CRITICAL 9.8
  • TI-2021-17355 Zoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution. CVSS 3.1CRITICAL 9.8
  • TI-2021-17357 Zoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite. CVSS 3.1CRITICAL 9.8
  • TI-2026-02867 Authentication bypass in Zohocorp ManageEngine Log360 CVSS 3.1HIGH 8.2
  • TI-2023-17875 Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and… CVSS 3.1HIGH 8.1
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences