Do Son 
TL;DR
Zoho released urgent patches to fix 11 bugs across ManageEngine Key Manager Plus, Log360, EventLog Analyzer, and PAM360. The flaws include one critical access bypass (CVE-2026-13594) and ten high-risk bugs for remote code execution. Network admins must update their servers right away to block potential attacks.
- Total: 11 CVEs
- Severity: 1 Critical · 10 High
- Actively exploited: None confirmed
- Highest severity: 9.1 (Critical · CVSSv3) — CVE-2026-13594
- Action: Apply the latest security updates now
Notable CVEs
| CVE | CVSS (CVSSv3) | Type | Fixed in | Status |
|---|---|---|---|---|
| CVE-2026-13594 | 9.1 | CWE-284 | 13062 | Not exploited |
| CVE-2026-18199 | 8.8 | CWE-78 | 13236, 8601 | Not exploited |
| CVE-2026-77690 | 8.8 | CWE-78 | 7151 | Not exploited |
| CVE-2026-8923 | 8.7 | CWE-78 | 13062 | Not exploited |
| CVE-2026-77691 | 8.1 | CWE-78 | 7151 | Not exploited |
| CVE-2026-77779 | 7.7 | CWE-1220 | 7151 | Not exploited |
| CVE-2026-77800 | 7.7 | CWE-304 | 7151 | Not exploited |
| CVE-2026-16900 | 7.5 | CWE-284 | 13071 | Not exploited |
Why It Matters
ManageEngine Key Manager Plus, PAM360, and Log360 store SSH keys, SSL certs, root passwords, and audit logs. Therefore, bugs in these tools put core company secrets at high risk. Both the official Zoho reports and the NVD database confirm the severe impact of these 11 flaws. Furthermore, CISA SSVC records state that no active attacks in the wild or public exploit tools exist. While exact install counts remain private, thousands of firms use ManageEngine tools for daily IT tasks.
How the Attack Works
Log360, EventLog Analyzer, and PAM360 Flaws
First, CVE-2026-13594 (CVSS 9.1) stems from weak access checks (CWE-284) in Log360 and EventLog Analyzer. Consequently, an unauthenticated attacker can gain rogue access to the software. Similarly, CVE-2026-16900 (CVSS 7.5) lets unauthenticated users register a local log collector via a crafted request. In addition, CVE-2026-8923 (CVSS 8.7) allows logged-in users to run code (CWE-78) through the Log Forward option. Meanwhile, CVE-2026-18199 (CVSS 8.8) enables remote code execution for logged-in users in Password Manager Pro and PAM360.
Key Manager Plus Command Injection and Access Bugs
Next, seven high-risk bugs hit ManageEngine Key Manager Plus. Specifically, CVE-2026-77690 (CVSS 8.8) and CVE-2026-77691 (CVSS 8.1) let logged-in users inject OS commands (CWE-78). Attackers trigger these bugs when they set up cert targets or Microsoft CA links. Moreover, CVE-2026-77800 (CVSS 7.7) lets attackers bypass SAML login using tokens meant for another app (CWE-304). Likewise, CVE-2026-77799 (CVSS 7.4) lets users with valid passwords skip two-factor checks without a code (CWE-288). Finally, three access bugs (CVE-2026-77779, CVE-2026-77778, and CVE-2026-77777) let low-level users export keys or certs and change ACME settings.
Affected Versions
These bugs affect ManageEngine Key Manager Plus builds before 7151, including CVE-2026-77799 on builds before 7150. They also hit Password Manager Pro builds before 13236 and PAM360 builds before 8601. Additionally, Log360 and EventLog Analyzer builds 13062 and below are open to CVE-2026-13594 and CVE-2026-8923. Builds 13071 and below are affected by CVE-2026-16900.
Patch and Mitigation Steps
Zoho fixed all seven ManageEngine Key Manager Plus flaws in build 7151. Admins should also update Password Manager Pro to build 13236 and PAM360 to build 8601. Likewise, teams must update Log360 and EventLog Analyzer past build 13071 via the ManageEngine software download portal. Finally, security teams should limit admin portal access to trusted networks and check logs for odd key exports.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
