Zohocorp ManageEngine Log360 and EventLog Analyzer customers can register a local collector without authentication by sending a specially crafted registration request. This flaw allows an unauthenticated actor to create a collector entry, potentially enabling the attacker to use the collector for data exfiltration, command execution, or other malicious actions depending on the privileges granted to locally registered collectors. The weakness is marked as CWE‑284, an improper access control vulnerability.

The vulnerability affects Zohocorp's EventLog Analyzer and Log360 products, specifically versions 13071 and earlier. Users running those versions should verify their installed version and apply any vendor updates.

The CVSS score of 7.5 indicates a high severity level. No EPSS score is available, and the flaw is not listed in CISA's KEV catalog, so the current exploit probability is unknown. The message states that authentication is bypassed for local collector registration, so the likely attack vector is a network-based or local attacker sending the crafted request to the registration endpoint. The lack of authentication requirement means that any host able to reach the target service can perform the exploit, making the risk significant for environments lacking network segmentation or access controls.