CVE-2014-6037: ManageEngine EventLog Analyzer agentUpload path traversal leads to remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe vulnerability allows unauthenticated remote code execution, public exploit code is available, and EPSS is very high, though it is not listed in CISA KEV.

What it is

The agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 is vulnerable to directory traversal. An attacker can upload a ZIP archive containing an executable whose name uses .. (dot dot) sequences to escape the intended upload directory, then request that file directly under the web root to execute it. The flaw is fixed in Build 11072.

Impact

A remote, unauthenticated attacker can write and execute arbitrary code on the server, gaining the privileges of the EventLog Analyzer service. This can lead to full compromise of the host and any data it processes.

Attack surface

Reachable over the network through the agentUpload servlet; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The attacker only needs to send a crafted ZIP upload and then a direct HTTP request to the dropped file.

Exploitation

CISA KEV does not list this CVE, but EPSS is very high (0.84182, 99.682nd percentile) and multiple references are tagged Exploit, including Exploit-DB, Packet Storm, Full Disclosure and a Metasploit pull request, indicating public exploit code exists.

What to do

• Upgrade ManageEngine EventLog Analyzer to Build 11072 or later, which contains the fix.
• If immediate upgrade is not possible, restrict network access to the agentUpload servlet and the web root to trusted management networks only.
• Validate and sanitize uploaded archive contents; reject filenames containing path traversal sequences before extraction.
• Run the EventLog Analyzer service with least privilege and isolate it from sensitive systems.
• Monitor for and remove unexpected executable files appearing under the web root.

Detection

• Inspect HTTP logs for POST requests to the agentUpload servlet followed by GET requests to newly created executable files under the web root.
• Alert on ZIP uploads whose contained filenames include .. or absolute path components.
• Monitor the web root and upload directories for new executable files (.exe, .jsp, .war, etc.) using file integrity monitoring.
• Correlate EventLog Analyzer process creation events with child processes spawned from the web server context.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.