CVE-2017-11685: Multiple Reflective cross-site scripting (XSS) vulnerabilities in search and display of event data in Zoho...

Security readout for executives and security teams

Zoho ManageEngine Event Log Analyzer 11.4 and 11.5 had multiple reflected XSS flaws in event search and display pages. A remote attacker could cause attacker-controlled script or HTML to run in a user’s browser if the user interacted with a crafted request. The source bundle does not provide CVSS, patch details, or active exploitation evidence. Exposure is likely limited to organizations still running ManageEngine Event Log Analyzer 11.4 or 11.5, especially if reachable from untrusted networks. Evidence for other versions is not provided. Treat this as a legacy product exposure issue. It is not listed as known exploited in the supplied data, but affected versions are old and may indicate broader maintenance risk. Prioritize discovery and upgrade planning over emergency response unless exposure or suspicious activity is found. Mitigation focus: Inventory Event Log Analyzer deployments and flag versions 11.4 or 11.5.; Check Zoho or ManageEngine guidance for fixed builds or supported upgrade paths.; Restrict application access to trusted networks where operationally possible..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.