Zoho Fixes 11 Flaws in ManageEngine Key Manager Plus, Log360, EventLog Analyzer and PAM360, Including a Critical Access Bypass
Zoho has patched 11 vulnerabilities affecting its ManageEngine Key Manager Plus, PAM360, Password Manager Pro, Log360, and EventLog Analyzer products, including one critical access-control bypass and ten high-severity bugs, several leading to remote code execution. These products centralize sensitive secrets such as SSH keys, SSL/TLS certificates, root passwords, and audit logs, making the flaws particularly dangerous for enterprise environments that rely on them for privileged access management. The most severe issue, CVE-2026-13594 (CVSS 9.1), is an unauthenticated access-control weakness (CWE-284) in Log360 and EventLog Analyzer. None of the 11 flaws is confirmed to be exploited in the wild, and no public exploit tools are known to exist.
Entenda a falha
A vulnerabilidade
Zoho fixed 11 flaws in ManageEngine products. The worst is CVE-2026-13594 (CVSS 9.1), an unauthenticated access-control weakness (CWE-284) in Log360 and EventLog Analyzer. Also affecting them: CVE-2026-16900 (7.5), where an unauthenticated crafted request registers a rogue local log collector, and CVE-2026-8923 (8.7), OS command injection by authenticated users via Log Forward. CVE-2026-18199 (8.8) is authenticated RCE in Password Manager Pro and PAM360. Key Manager Plus has seven high-severity bugs: command injection CVE-2026-77690 and CVE-2026-77691, a SAML bypass (CVE-2026-77800), a 2FA bypass (CVE-2026-77799) and three broken access controls (CVE-2026-77779, -77778, -77777). Fixed in Key Manager Plus build 7151 (7150 for CVE-2026-77799), Password Manager Pro 13236, PAM360 8601. Log360/EventLog Analyzer builds 13062 and below (13071 and below for CVE-2026-16900) are affected.
Como funciona
The articles give only a high-level picture. In the command injection bugs, an authenticated user with certificate deployment privileges configures certificate deployment targets or Microsoft CA integrations in Key Manager Plus, and input from that configuration ends up executing as an OS command. In Log360 and EventLog Analyzer, the Log Forward option plays the same role for CVE-2026-8923. For CVE-2026-16900, a crafted request is accepted by the server and registers a local log collector without any login. In the access-control bugs, low-privileged users reach key and certificate export or ACME settings during certificate deployment, agent-based operations and challenge deployment.
Por que é vulnerável
The flaws fall into a few classes. Command injection (CWE-78) comes from configuration input reaching OS command execution without proper handling. The access bugs are missing or weak authorization checks (CWE-284), including low-privileged users doing privileged actions. The authentication bugs are a SAML flow that accepts tokens scoped for another application (CWE-304) and a 2FA step that can be skipped by someone with a valid password (CWE-288). The articles do not explain why these went unnoticed or detail the code changes; the fix is in the patched builds.
Onde está
The articles name no files or functions; they only point to the Log Forward feature (Log360/EventLog Analyzer) and to certificate deployment targets and Microsoft CA integrations (Key Manager Plus).
Como foi descoberta
The articles do not say who found the flaws or how. The story, citing vuldb.com, says the CVE-2026-77690 record was reserved on 21 August 2026 and publicly disclosed on 4 November 2026, matching the build 7151 fix. Disclosure came through the vendor advisory, release notes and CVE/NVD records. CISA SSVC records indicate no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 23:18.
Detalhes técnicos
In Log360/EventLog Analyzer, besides CVE-2026-13594, CVE-2026-16900 (CVSS 7.5) allows unauthenticated registration of a rogue local log collector via a crafted request, and CVE-2026-8923 (CVSS 8.7) lets authenticated users achieve OS command injection (CWE-78) through the Log Forward feature. CVE-2026-18199 (CVSS 8.8) enables authenticated remote code execution in Password Manager Pro and PAM360. In Key Manager Plus, seven high-severity bugs were fixed: CVE-2026-77690 (CVSS 8.8) and CVE-2026-77691 (CVSS 8.1) are OS command-injection flaws (CWE-78) triggered by authenticated users configuring certificate deployment targets or Microsoft CA integrations — confirmed by the vendor advisory and CVE record as requiring "authenticated users with certificate deployment privileges" to execute arbitrary commands (nvd.nist.gov, manageengine.com). CVE-2026-77800 (CVSS 7.7) permits a SAML authentication bypass using tokens scoped for another application (CWE-304), and CVE-2026-77799 (CVSS 7.4) allows users with valid passwords to bypass two-factor authentication without a code (CWE-288). Three additional broken access-control flaws (CVE-2026-77779, CVE-2026-77778, CVE-2026-77777) allow low-privileged users to export keys/certificates or alter ACME settings during certificate deployment, agent-based operations, and challenge deployment.
Detalhes da correção
Zoho fixed all seven Key Manager Plus flaws in build 7151 (released August 2026), with release notes confirming fixes for the RCE pair (CVE-2026-77690, CVE-2026-77691) and the three broken access-control issues (CVE-2026-77778, CVE-2026-77777, CVE-2026-77779) (manageengine.com). CVE-2026-77799 was fixed starting from build 7150. Password Manager Pro is fixed in build 13236 and PAM360 in build 8601 for CVE-2026-18199. Log360 and EventLog Analyzer builds 13062 and below remain vulnerable to CVE-2026-13594 and CVE-2026-8923, while builds 13071 and below are affected by CVE-2026-16900; fixes are available in builds above these thresholds. The CVE-2026-77690 record shows it was reserved on 21 August 2026 and publicly disclosed on 4 November 2026, matching the build 7151 hotfix timeline (vuldb.com).
Remediação
Administrators should update ManageEngine Key Manager Plus to build 7151 or later, Password Manager Pro to build 13236, PAM360 to build 8601, and Log360/EventLog Analyzer beyond build 13071, all via the official ManageEngine software download portal. Organizations should additionally restrict admin portal access to trusted networks and audit logs for unusual key or certificate export activity.
Linha do tempo
-
Zoho Fixes 11 Flaws in ManageEngine Key Manager Plus, Log360, EventLog Analyzer and PAM360, Including a Critical Access Bypass
ler a análise desta fonte ocultar
Zoho has patched 11 vulnerabilities affecting its ManageEngine Key Manager Plus, PAM360, Password Manager Pro, Log360, and EventLog Analyzer products, including one critical access-control bypass and ten high-severity bugs, several leading to remote code execution. These products centralize sensitive secrets such as SSH keys, SSL/TLS certificates, root passwords, and audit logs, making the flaws particularly dangerous for enterprise environments that rely on them for privileged access management. The most severe issue, CVE-2026-13594 (CVSS 9.1), is an unauthenticated access-control weakness (CWE-284) in Log360 and EventLog Analyzer. None of the 11 flaws is confirmed to be exploited in the wild, and no public exploit tools are known to exist.
Technical Details
In Log360/EventLog Analyzer, besides CVE-2026-13594, CVE-2026-16900 (CVSS 7.5) allows unauthenticated registration of a rogue local log collector via a crafted request, and CVE-2026-8923 (CVSS 8.7) lets authenticated users achieve OS command injection (CWE-78) through the Log Forward feature. CVE-2026-18199 (CVSS 8.8) enables authenticated remote code execution in Password Manager Pro and PAM360. In Key Manager Plus, seven high-severity bugs were fixed: CVE-2026-77690 (CVSS 8.8) and CVE-2026-77691 (CVSS 8.1) are OS command-injection flaws (CWE-78) triggered by authenticated users configuring certificate deployment targets or Microsoft CA integrations — confirmed by the vendor advisory and CVE record as requiring "authenticated users with certificate deployment privileges" to execute arbitrary commands (nvd.nist.gov, manageengine.com). CVE-2026-77800 (CVSS 7.7) permits a SAML authentication bypass using tokens scoped for another application (CWE-304), and CVE-2026-77799 (CVSS 7.4) allows users with valid passwords to bypass two-factor authentication without a code (CWE-288). Three additional broken access-control flaws (CVE-2026-77779, CVE-2026-77778, CVE-2026-77777) allow low-privileged users to export keys/certificates or alter ACME settings during certificate deployment, agent-based operations, and challenge deployment.
Fix Details
Zoho fixed all seven Key Manager Plus flaws in build 7151 (released August 2026), with release notes confirming fixes for the RCE pair (CVE-2026-77690, CVE-2026-77691) and the three broken access-control issues (CVE-2026-77778, CVE-2026-77777, CVE-2026-77779) (manageengine.com). CVE-2026-77799 was fixed starting from build 7150. Password Manager Pro is fixed in build 13236 and PAM360 in build 8601 for CVE-2026-18199. Log360 and EventLog Analyzer builds 13062 and below remain vulnerable to CVE-2026-13594 and CVE-2026-8923, while builds 13071 and below are affected by CVE-2026-16900; fixes are available in builds above these thresholds. The CVE-2026-77690 record shows it was reserved on 21 August 2026 and publicly disclosed on 4 November 2026, matching the build 7151 hotfix timeline (vuldb.com).
Remediation
Administrators should update ManageEngine Key Manager Plus to build 7151 or later, Password Manager Pro to build 13236, PAM360 to build 8601, and Log360/EventLog Analyzer beyond build 13071, all via the official ManageEngine software download portal. Organizations should additionally restrict admin portal access to trusted networks and audit logs for unusual key or certificate export activity.