ManageEngine Log360 Local Collector Authentication Bypass

CVE-2026-16900 exposes a critical authentication bypass vulnerability in Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below. The flaw resides in the local collector registration mechanism, where an unauthenticated attacker can register a malicious collector by crafting a specially designed registration request. This vulnerability is particularly dangerous because Log360 and EventLog Analyzer are central security information and event management (SIEM) platforms deployed across enterprises to collect, correlate, and analyze security logs. Compromising collector registration could allow an attacker to inject malicious data, poison log streams, or establish a foothold within the organization's security infrastructure. Any organization running affected versions faces immediate risk of unauthorized collector deployment and potential data integrity compromise.

While this CVE currently shows zero matching skills in Casky's 754 MITRE ATT&CK-mapped capabilities, practitioners should focus detection efforts on authentication and access control anomalies (CWE-284). Security teams monitoring ManageEngine environments would identify suspicious patterns through Casky's extended reasoning capabilities by looking for unauthenticated registration requests, anomalous collector onboarding processes, and deviations from normal administrative workflows. The underlying attack pattern falls within initial access and persistence techniques—identifying registration requests lacking proper authentication tokens, unusual collector configuration changes, or unfamiliar collector identities connecting to the Log360 infrastructure. Practitioners should implement network segmentation around Log360 components and apply the vendor's patches immediately, while conducting forensic review of collector registrations to identify any unauthorized entries within their SIEM environment.