CVE-2014-6039: ManageEngine EventLog Analyzer credential disclosure

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityUnauthenticated remote credential disclosure with public exploit references and very high EPSS, though not in KEV and requiring an unpatched legacy version.

What it is

ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 expose credentials through insufficiently protected storage (CWE-522). The flaw is remotely reachable without authentication and leaks sensitive credential data, which matters because those credentials can unlock further systems. The record does not specify the exact disclosure mechanism beyond the SQL credential disclosure reference title.

Impact

An unauthenticated attacker gains access to credentials, likely database or application credentials, enabling lateral movement or direct access to connected systems.

Attack surface

Reachable over the network with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description does not state which endpoint or interface exposes the credentials.

Exploitation

Not listed in CISA KEV, but EPSS is 0.68779 (99.3rd percentile) and multiple references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade to ManageEngine EventLog Analyzer 10 Build 10000 or later, the stated fixed version.
• If upgrade is not immediate, restrict network access to the EventLog Analyzer interface to trusted management networks only.
• Rotate any credentials that may have been exposed by the affected instance, including database and service accounts.
• Audit logs for access to the vulnerable interface from untrusted sources.

Detection

• Monitor network logs for unauthenticated requests to EventLog Analyzer endpoints from unexpected hosts.
• Search application and web server logs for patterns matching the public exploit references.
• Alert on outbound authentication attempts using EventLog Analyzer service or database credentials from unusual sources.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.