DoS in Zoho ManageEngine EventLog Analyzer and Log360

Executive Summary

CVE-2026-92905 is a medium-severity denial-of-service vulnerability affecting ZohoCorp ManageEngine EventLog Analyzer and Log360. It allows attackers to crash the log collector service by sending malformed syslog packets to the syslog listener port. The service crashes unexpectedly and requires manual restart or update to resume normal operation.

Useful 0 Not Useful 0

Detection Guidance

Monitor for unexpected crashes of the log collector service in EventLog Analyzer or Log360. Check for malformed syslog packets reaching the syslog listener port (typically UDP 514). Use network monitoring tools like Wireshark to capture and analyze syslog traffic for anomalies.

Useful 0 Not Useful 0

Impact Analysis

An unauthenticated attacker with network access to the syslog listener could exploit this flaw to disrupt syslog collection. This may lead to loss of critical log data, service downtime, and potential gaps in monitoring or auditing capabilities until the service is manually restarted or updated.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by causing interruptions in log collection, which may result in incomplete audit trails or missing critical logs required for compliance reporting under standards like GDPR or HIPAA. Organizations must ensure continuous logging to meet regulatory requirements.

Useful 0 Not Useful 0

Mitigation Strategies

Update EventLog Analyzer and Log360 to build 13071 or later. Ensure input validation is enabled to discard malformed syslog datagrams. Restrict network access to the syslog listener port to trusted sources only.

Useful 0 Not Useful 0