Zoho Corporation’s ManageEngine Log360 and EventLog Analyzer suffer from an improper access control flaw, allowing an adversary to gain unauthorized access to the product’s administrative functions. The vulnerability can compromise confidentiality and integrity by enabling attackers to read, modify, or delete log data and configuration settings. The weakness is an instance of CWE-284, where authentication and authorization checks are insufficient or missing.

Zoho Corp’s Log360 and EventLog Analyzer products, specifically versions 13062 and earlier, are affected. Users of these products should verify the exact build and update to a newer version if available.

The CVSS score of 9.1 indicates a very high severity, but the EPSS score is not available, so the exact likelihood of exploitation is unknown. The vulnerability is not listed in CISA KEV, suggesting no confirmed exploitation in the wild. Based on the description, the likely attack vector is through the web interface or internal network access that does not enforce proper authorization controls. Additional information on prerequisites or exploitation steps is not provided, so the assessment assumes that standard authentication mechanisms are bypassed by the flaw.