← Vulnerability feed

Vulnerability record · CVE-2021-20136 · published 1 November 2021

CVE-2021-20136: Zohocorp manageengine log360 missing authentication for critical function vulnerability

Zohocorp · Manageengine Log360

ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup.

9.8 CVSS 3.1 Critical EPSS 11% · top 4.3% CWE-306 · Missing authentication for critical function
9.8CVSS 3.1 base score, v2 7.5
11%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An unauthenticated remote attacker can send a specially crafted message to Log360 to change its backend database to an attacker-controlled database and to force Log360 to restart. An attacker can leverage this vulnerability to achieve remote code execution by replacing files executed by Log360 on startup.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.tenable.com/security/research/tra-2021-48 ExploitThird Party Advisory
https://www.tenable.com/security/research/tra-2021-48 ExploitThird Party Advisory

Track CVE-2021-20136 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-40175Zohocorp manageengine log360 unrestricted file upload vulnerabilityZoho ManageEngine Log360 before Build 5219 allows unrestricted file upload with resultant remote code execution.EPSS 7.0%9.8CVE-2021-40177Zohocorp manageengine log360 vulnerabilityZoho ManageEngine Log360 before Build 5225 allows remote code execution via BCP file overwrite.EPSS 4.6%9.8CVE-2020-24786Zohocorp manageengine adselfservice plus improper authentication vulnerabilityAn issue was discovered in Zoho ManageEngine Exchange Reporter Plus before build number 5510, AD360 before build number 4228, ADSelfService Plus befo…EPSS 13%8.8CVE-2021-40172Zohocorp manageengine log360 cross-site request forgery vulnerabilityZoho ManageEngine Log360 before Build 5219 allows a CSRF attack on proxy settings.EPSS 0.99%8.8CVE-2021-40174Zohocorp manageengine log360 cross-site request forgery vulnerabilityZoho ManageEngine Log360 before Build 5224 allows a CSRF attack for disabling the logon security settings.EPSS 0.99%8.2CVE-2026-3324Zohocorp manageengine log360 authentication bypass via alternate path vulnerabilityZohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configura…EPSS 2.1%8.1CVE-2023-35785Zohocorp manageengine ad360 improper authentication vulnerabilityZoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6993 and b…EPSS 2.4%6.1CVE-2021-40176Zohocorp manageengine log360 cross-site scripting vulnerabilityZoho ManageEngine Log360 before Build 5225 allows stored XSS.EPSS 0.82%

Source: NIST National Vulnerability Database (record CVE-2021-20136), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.