CVE-2026-13594
CRITICALCVSS 9.1/10EPSS 1.14%
Last modified
CVE-2026-13594 is a critical-severity vulnerability rated 9.1/10 on the CVSS scale. Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.. EPSS estimates a 1.14% chance of exploitation in the next 30 days.
Description
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Zohocorp | Log360 | < 13062 |
| Zohocorp | EventLog Analyzer | < 13062 |
References
Timeline
- Published
- Last Modified
- Status
- Awaiting Analysis
Frequently Asked Questions
What is CVE-2026-13594?
Zoho Corporation's ManageEngine Log360 and EventLog Analyzer versions 13062 and below are vulnerable to an issue that could allow an adversary to gain unauthorized access to the product.
How severe is CVE-2026-13594?
CVE-2026-13594 has a CVSS score of 9.1/10 (CRITICAL severity). The EPSS model estimates a 1.14% probability of exploitation in the next 30 days.
How do I fix CVE-2026-13594?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-13589A vulnerability was identified in seladb PcapPlusPlus 25.05.…5.6
- CVE-2026-1359The Genolve – AI image AI video generation plugin for WordPr…8.8
- CVE-2026-13590A security flaw has been discovered in seladb PcapPlusPlus 2…5.6
- CVE-2026-13591A weakness has been identified in DeepMyst Mysti 0.4.0. Affe…5
- CVE-2026-13592A vulnerability was detected in liftoff-sr CIPster up to e8e…7.3
- CVE-2026-13593CSS::Minifier::XS versions before 0.14 for Perl have a memor…6.5
- CVE-2026-13595A flaw was found in the libblkid library of util-linux. Duri…5.3
- CVE-2026-13596The Participants Database WordPress plugin before 2.7.8.4 do…9.1
- CVE-2026-13597The 微信二维码登陆 WordPress plugin through 1.3 does not properly v…9.1
- CVE-2026-13598The RestrictMate WordPress plugin before 1.3.0 does not res…9.8
- CVE-2026-13599Missing authentication for critical function vulnerability i…7.8
- CVE-2026-1360The BuddyPress plugin for WordPress is vulnerable to Deseria…7.5
Are you affected by CVE-2026-13594?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST