Zohocorp ManageEngine Log360 versions 13.0.0 through 13.0.13 allow an attacker to bypass authentication on certain privileged actions. The flaw arises from an improper filter configuration that can be exploited to gain unauthorized access, effectively allowing an attacker to log in without credentials. This violation of authentication integrity is categorized as CWE‑288, which directly compromises system security and confidentiality.

The affected product is Zohocorp ManageEngine Log360, specifically versions 13.0.0 to 13.0.13 inclusive. Users running any of these versions are vulnerable to the described authentication bypass.

The vulnerability carries a CVSS score of 8.2, indicating high severity. EPSS data is currently unavailable, so while the exact likelihood of exploitation is unknown, the high CVSS score suggests a significant risk if exploited. The flaw is not yet listed in the CISA KEV catalog. The likely attack vector involves both remote exploitation over a network that can reach the Log360 instance and local attackers with network access, as the bypass operates through misconfigured system filters that can be triggered via HTTP requests to privileged actions.