Zoho patches 11 flaws in ManageEngine security products

SecurityOnline[.]info reports that Zoho has released urgent patches addressing 11 vulnerabilities across ManageEngine Key Manager Plus, Log360, EventLog Analyzer, and PAM360. The bulletin highlights one critical flaw, CVE-2026-13594, and ten high‑risk bugs capable of remote code execution.

The outlet notes that, at present, no active exploitation is confirmed, but administrators are urged to apply the fixes promptly to prevent potential access to SSH keys, SSL certs, root passwords and audit logs stored by these products. Highest severity is CVSS 9.1 for CVE-2026-13594, with several other CVEs rated in the high range (up to CVSSv3 8.8). The article cites Zoho and the NVD as corroborating the risk, with CISA SSVC indicating no known active campaigns.

SecurityOnline[.]info itemises the affected components and versions, detailing CVEs tied to various components: CVE-2026-13594 affects Log360 and EventLog Analyzer; CVE-2026-16900 enables unauthenticated registration of a local log collector; CVE-2026-8923 enables code execution via the Log Forward option; CVE-2026-18199 allows remote code execution for logged‑in users in

Password Manager Pro and PAM360; and seven Key Manager Plus flaws (including CVE-2026-77690 and CVE-2026-77691) involve OS command injection, with additional issues enabling SAML bypass, two‑factor circumvention, and export of keys or certificates by low‑privilege users.

Affected builds are listed as Key Manager Plus before 7151; Password Manager Pro before 13236; PAM360 before 8601; and Log360/EventLog Analyzer up to 13071 or 13062 in different combinations. The patch guidance directs admins to update to builds 7151 (Key Manager Plus), 13236 (Password Manager Pro), 8601 (PAM360), and beyond 13071 for Log360/EventLog Analyzer, while restricting admin portal access and monitoring for anomalous key exports.