Multiple vulnerabilities have been identified in ManageEngine Key Manager Plus, Log360, EventLog Analyzer, and PAM360, affecting builds prior to specific recent releases. These flaws expose critical infrastructure components to significant risk, including unauthorized access and remote code execution. The overall risk is severe, as these tools manage sensitive credentials and audit logs, making them high-value targets for attackers.
CVE-2026-13594 (CVSS 9.1 — Critical): This Improper Access Control vulnerability in Log360 and EventLog Analyzer permits unauthenticated attackers to gain rogue access to the software. The weak access checks allow malicious actors to bypass standard security controls and interact with the system without valid credentials.[/subscribe_to_unlock_form]
Multiple vulnerabilities have been identified in ManageEngine Key Manager Plus, Log360, EventLog Analyzer, and PAM360, affecting builds prior to specific recent releases. These flaws expose critical infrastructure components to significant risk, including unauthorized access and remote code execution. The overall risk is severe, as these tools manage sensitive credentials and audit logs, making them high-value targets for attackers.
CVE-2026-13594 (CVSS 9.1 — Critical): This Improper Access Control vulnerability in Log360 and EventLog Analyzer permits unauthenticated attackers to gain rogue access to the software. The weak access checks allow malicious actors to bypass standard security controls and interact with the system without valid credentials.[emaillocker id="1283"]
CVE-2026-18199 (CVSS 8.8 — High): This OS Command Injection issue affects Password Manager Pro and PAM360, allowing logged-in users to execute remote code. The flaw enables attackers to run arbitrary commands on the server, potentially leading to full system compromise.
CVE-2026-77690 (CVSS 8.8 — High): This OS Command Injection flaw in ManageEngine Key Manager Plus allows logged-in users to inject operating system commands. The vulnerability is triggered when configuring certificate targets or Microsoft CA links, enabling unauthorized system-level execution.
CVE-2026-8923 (CVSS 8.7 — High): This OS Command Injection vulnerability in Log360 allows logged-in users to execute code through the Log Forward option. Attackers can exploit this feature to run malicious commands on the underlying operating system.
CVE-2026-77691 (CVSS 8.1 — High): This OS Command Injection flaw in ManageEngine Key Manager Plus allows logged-in users to inject operating system commands. Similar to other command injection issues, this is triggered during the setup of certificate targets or Microsoft CA links.
CVE-2026-77779 (CVSS 7.7 — High): This Insufficient Granularity of Access Control vulnerability in ManageEngine Key Manager Plus allows low-level users to export keys or certificates. The flaw permits unauthorized access to sensitive cryptographic material that should be restricted to higher-privilege roles.
CVE-2026-77800 (CVSS 7.7 — High): This Missing Step in Authentication vulnerability in ManageEngine Key Manager Plus allows attackers to bypass SAML login. The flaw enables the use of tokens intended for another application to gain unauthorized access to the system.
CVE-2026-16900 (CVSS 7.5 — High): This Improper Access Control vulnerability in Log360 and EventLog Analyzer allows unauthenticated users to register a local log collector. Attackers can exploit this via a crafted request to establish a malicious connection with the logging infrastructure.
CVE-2026-77799 (CVSS 7.4 — High): This vulnerability in ManageEngine Key Manager Plus allows users with valid passwords to skip two-factor authentication checks. The flaw enables bypassing the second factor of authentication without providing a code, weakening the overall security posture.
CVE-2026-77778 (CVSS 7.1 — High): This access control vulnerability in ManageEngine Key Manager Plus allows low-level users to change ACME settings. The flaw permits unauthorized modifications to configuration parameters that should be restricted to administrative roles.
CVE-2026-77777 (CVSS 7.1 — High): This access control vulnerability in ManageEngine Key Manager Plus allows low-level users to export keys or certificates. The flaw permits unauthorized access to sensitive cryptographic material, similar to other access control issues in the same product.
The following reports contain further technical details:
[/emaillocker]