ManageEngine M365 Manager Plus CVE-2026-16053

Exploitation requires a valid authenticated session with at least low-level privileges on the ManageEngine M365 Manager Plus or M365 Security Plus instance - unauthenticated exploitation is not possible given PR:L in the CVSS vector. The vulnerability is specifically located in the Exchange Online backup module; instances where this module is not configured or not in use reduce but do not eliminate risk (the module may still be accessible). Network access to the application's web interface is required (AV:N). No user interaction by a victim is needed beyond the attacker's own session. Exploitation is limited to authenticated low-privilege users - anonymous external attackers cannot directly exploit this without first obtaining credentials. The scope change (S:C) means impact extends to file system paths outside the application's own directory, but the absence of confidentiality impact (C:N) limits the attacker's read-based exfiltration ability through this vector.

The CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H) reflects a realistic and concerning profile: network-accessible, low complexity, requiring only a low-privilege authenticated session, with no user interaction and a scope change that drives the high availability impact. The absence of confidentiality impact (C:N) is notable - this is not a data-exfiltration path traversal but one enabling file writes or deletions outside the application boundary, potentially disrupting backup integrity or system-level file availability. EPSS data is not available in the provided intelligence, so exploitation probability cannot be quantified. KEV status is negative and no POC is identified, reducing urgency slightly. However, ManageEngine products have a historical pattern of exploitation following advisory publication - this class of vulnerability in this vendor's ecosystem warrants prompt remediation rather than a wait-and-see posture. CVSS signals and description are consistent; no conflicting indicators were observed.

An attacker with a valid low-privilege account on an affected M365 Manager Plus or M365 Security Plus instance - such as a read-only reporting user - submits a crafted backup request to the Exchange Online backup module containing path traversal sequences in a file path parameter. The manipulated path escapes the application's backup directory and writes to or deletes files in an adjacent directory on the host, causing service disruption or corruption of critical configuration or data files. No public proof-of-concept exploit has been identified at time of analysis, but the low attack complexity means exploitation requires no specialized tooling beyond a crafted HTTP request.