CVE-2021-28959

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 16.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-30 · updated 2026-06-17
Weakness: CWE-22

Description

Zoho ManageEngine Eventlog Analyzer through 12147 is vulnerable to unauthenticated directory traversal via an entry in a ZIP archive. This leads to remote code execution.

Affected products

Zohocorp ManageEngine EventLog Analyzer: before 12.1.4; 12.1.4, 12.1.4-12141, 12.1.4-12145, 12.1.4-12146 — fixed in 12.1.4

How to fix

Upgrade to a fixed version: Zohocorp ManageEngine EventLog Analyzer 12.1.4. Check the vendor advisory for mitigations.

References

https://www.manageengine.com
https://www.manageengine.com/products/eventlog/features-new.html#release
https://www.manageengine.com
https://www.manageengine.com/products/eventlog/features-new.html#release

Get alerted when CVE-2021-28959 or the next vulnerability affects your stack