CVE-2026-8923

Summary

Authenticated users with elevated privileges can inject OS commands into the Log Forward feature of Zoho ManageEngine Eventlog Analyzer and Log360 versions before 13062, leading to remote code execution on the server.

Exploitability

Exploitation requires valid credentials with high-privilege access (PR:H) and no user interaction (UI:N), making it feasible for compromised admin accounts but not for anonymous attackers.

Blast radius

Successful exploitation allows full compromise of confidentiality and integrity on the affected server, potentially enabling lateral movement or data exfiltration from security logs.

Detection

Monitor for unusual outbound network connections or unexpected child process spawns (e.g., cmd.exe, bash, powershell) initiated by the Eventlog Analyzer service account; inspect application logs for malformed or injected command strings in Log Forward configuration entries.

Prioritized remediation

Upgrade to version 13062 or later, which contains the vendor's fix for the authenticated RCE vulnerability in the Log Forward functionality.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.