Zoho has patched 11 vulnerabilities across four ManageEngine products: Key Manager Plus, Log360, EventLog Analyzer and PAM360 along with Password Manager Pro. One is critical and ten are high severity, and no known exploitation or public exploit tools exist, according to CISA SSVC data and the National Vulnerability Database.
CVE-2026-13594 Opens Log360 and EventLog Analyzer
The critical flaw is CVE-2026-13594, scored 9.1 and classified as CWE-284, an access-control weakness in Log360 and EventLog Analyzer. It lets an unauthenticated attacker gain access. Zoho fixed it in build 13062.
Log Collector Registration and Log Forward Flaws
CVE-2026-16900, scored 7.5, allows unauthenticated registration of a local log collector through a crafted request. The fix is in build 13071. CVE-2026-8923, scored 8.7, permits authenticated code execution through the Log Forward option and is fixed in build 13062.
Authenticated Code Execution in Password Manager Pro and PAM360
CVE-2026-18199, scored 8.8, is an authenticated remote code execution flaw in Password Manager Pro and PAM360. Zoho addressed it in builds 13236 and 8601.
Seven High-Severity Flaws in Key Manager Plus
Seven high-severity flaws affect Key Manager Plus. They include command injection flaws CVE-2026-77690, scored 8.8, and CVE-2026-77691, scored 8.1. CVE-2026-77779 and CVE-2026-77800 each score 7.7. All are fixed in build 7151.
Why ManageEngine Key and Log Products Hold Sensitive Material
The affected products store SSH keys, SSL certificates, root passwords and audit logs. Credential vaults and log systems hold material that grants access to other systems and records of what happened on them, which raises the stakes of any code-execution or access-control flaw.
No Known Exploitation of the Eleven ManageEngine Flaws
CISA’s SSVC data and the NVD show no known exploitation and no public exploit tools for any of the 11 flaws. The coverage was published on Nov. 6, the same day as the patches.
ManageEngine Patch Builds for Log360, PAM360 and Key Manager Plus
The fixes are spread across several builds, so the build numbers differ by product. Log360 and EventLog Analyzer fixes land in builds 13062 and 13071. Password Manager Pro and PAM360 are fixed in builds 13236 and 8601. Key Manager Plus is fixed in build 7151.
The flaws split between those requiring no login and those requiring an authenticated user. CVE-2026-13594 and CVE-2026-16900 are reachable by unauthenticated attackers, while the code-execution and command-injection issues require an authenticated account. The reporting does not give details of how each flaw was found or who reported it.
For privileged-credential and log-management systems, remote code execution for either type of attacker carries impact beyond the product itself, because those platforms keep the keys and records used across an organization. The advisory presents the fixes as a single set of updates across the four product lines.
The 11 CVEs cover three vulnerability groupings in the source: one critical access-control flaw, a handful of code-execution and injection issues, and a log-collector registration weakness. With no exploitation reported, the update is, for now, a matter of closing the gap before attackers develop working exploits from the patch details.
Breakdown of the Eleven CVEs by Severity and Product
The batch contains one critical flaw and ten high-severity flaws. Log360 and EventLog Analyzer share CVE-2026-13594, CVE-2026-16900 and CVE-2026-8923. Password Manager Pro and PAM360 share CVE-2026-18199. Key Manager Plus accounts for seven of the eleven, including the two command injection flaws, which carry scores of 8.8 and 8.1. SecurityOnline reported the full set on Nov. 6.
Affected ManageEngine Products and Their Roles
Key Manager Plus manages keys and certificates, Log360 and EventLog Analyzer handle log data, and Password Manager Pro and PAM360 manage privileged passwords. The reporting notes that between them the products store SSH keys, SSL certificates, root passwords and audit logs. No exploitation has been recorded, and the update details come from a single source report published on Nov. 6.
