CVE-2026-92905: 
Zoho ManageEngine EventLog Analyzer 脆弱性の分析と軽減

CVE-2026-92905 is a denial-of-service (DoS) vulnerability in the log collector component of ZohoCorp ManageEngine EventLog Analyzer and Log360. Malformed syslog datagrams sent to the syslog listener port are not handled correctly, causing the collector service to crash unexpectedly. All builds prior to 13071 are affected; the vulnerability was disclosed and patched on August 25, 2026, with the advisory published September 24, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (ManageEngine Advisory, GitHub Advisory).

The root cause is an uncaught exception (CWE-248) in the syslog listener of the log collector component, where malformed syslog datagrams are not discarded safely and instead cause the service to terminate. An unauthenticated, network-adjacent attacker can send specially crafted malformed syslog packets to the syslog listener port without any credentials or user interaction required. The fix improves input validation so that malformed datagrams are silently discarded and the service continues running (ManageEngine Advisory, GitHub Advisory).

Successful exploitation causes the log collector service to crash, interrupting syslog collection until the service is restarted or the patch is applied. There is no confidentiality or integrity impact — the vulnerability is limited to availability. In environments relying on EventLog Analyzer or Log360 for security monitoring and compliance, a sustained attack could create blind spots in log visibility, potentially masking other malicious activity (ManageEngine Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at the time of disclosure. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.0235, indicating a low probability of exploitation in the near term. Notably, the attack is automatable and requires no authentication, meaning a low-skilled attacker could trigger the DoS with minimal effort (GitHub Advisory, ManageEngine Advisory).

1. Reconnaissance: Identify hosts running ManageEngine EventLog Analyzer or Log360 (builds prior to 13071) with their syslog listener port exposed on the network (typically UDP/514 or a configured alternative).
2. Craft malformed syslog packet: Construct a UDP datagram that violates the syslog protocol format (e.g., invalid priority field, oversized header, or malformed structured data) intended to trigger an uncaught exception in the log collector.
3. Send packet to syslog listener: Transmit the malformed datagram to the target's syslog listener port using standard network tools (e.g., netcat, scapy, or a custom script).
4. Crash the log collector: The unhandled exception causes the log collector service to stop unexpectedly, interrupting syslog ingestion until the service is manually restarted or the patch is applied (ManageEngine Advisory).

• Network: Unexpected or malformed UDP packets arriving at the syslog listener port (typically UDP/514) from untrusted or external sources; high-volume syslog traffic from a single source IP.
• Logs: Sudden absence of syslog ingestion events in EventLog Analyzer or Log360; service crash or restart entries in the application or system event logs around the time of the attack.
• Process: Unexpected termination or restart of the log collector service process; crash dump files generated by the ManageEngine log collector component.

ZohoCorp has addressed the vulnerability in build 13071, released August 25, 2026. Users should update EventLog Analyzer and Log360 to build 13071 or later using the official service pack links provided by ManageEngine. As a network-level workaround, restrict access to the syslog listener port to only trusted, known syslog sources using firewall rules or network ACLs, and monitor for anomalous syslog traffic patterns (ManageEngine Advisory).

The vulnerability was discovered by a researcher named Seth through the Zoho Bug Bounty Program and responsibly disclosed to ZohoCorp. No significant public commentary, media coverage, or notable researcher reactions beyond the vendor advisory have been observed at this time (ManageEngine Advisory).