EUVD-2026-55969
GHSA-pr9p-8j6v-r9pp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Requires authenticated low-privilege session (PR:L); network-accessible backup module with no interaction needed; scope change justified by traversal reaching outside application directory boundary.
Primary rating from Vendor (0fc0942c-577d-436f-ae8e-945763c79b02).
CVSS VectorVendor: 0fc0942c-577d-436f-ae8e-945763c79b02
Lifecycle Timeline
3DescriptionCVE.org
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
AnalysisAI
Authenticated path traversal in Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus (versions below 4820) allows a low-privileged authenticated attacker to traverse outside intended directory boundaries within the Exchange Online backup module, resulting in high availability impact and limited integrity compromise across a changed scope. The vendor has released a patched build (4820) and published an advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session with at least low-level privileges on the ManageEngine M365 Manager Plus or M365 Security Plus instance - unauthenticated exploitation is not possible given PR:L in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 8.5 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H) reflects a realistic and concerning profile: network-accessible, low complexity, requiring only a low-privilege authenticated session, with no user interaction and a scope change that drives the high availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade ManageEngine M365 Manager Plus and M365 Security Plus to build 4820 or later, as released by Zohocorp. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all ManageEngine M365 Manager Plus and M365 Security Plus deployments and document current build versions below 4820 to assess exposure scope and risk tier by user role and data classification. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today