EUVD-2026-55969
GHSA-pr9p-8j6v-r9pp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Requires authenticated low-privilege session (PR:L); network-accessible backup module with no interaction needed; scope change justified by traversal reaching outside application directory boundary.
Primary rating from Vendor (0fc0942c-577d-436f-ae8e-945763c79b02).
CVSS VectorVendor: 0fc0942c-577d-436f-ae8e-945763c79b02
Lifecycle Timeline
3DescriptionCVE.org
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
AnalysisAI
Authenticated path traversal in Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus (versions below 4820) allows a low-privileged authenticated attacker to traverse outside intended directory boundaries within the Exchange Online backup module, resulting in high availability impact and limited integrity compromise across a changed scope. The vendor has released a patched build (4820) and published an advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network accessibility make this a credible threat in environments running affected builds.
Technical ContextAI
The vulnerability is rooted in CWE-23 (Relative Path Traversal), where user-controlled input is used to construct file paths in the Exchange Online backup module without adequate sanitization or canonicalization, permitting sequences such as '../' to escape the intended backup directory. ManageEngine M365 Manager Plus and M365 Security Plus are Zoho-developed SaaS management and reporting platforms for Microsoft 365 tenants, handling Exchange Online, SharePoint, and Teams administration. The affected component - the Exchange Online backup module - processes user-supplied path parameters during backup operations, and the CVSS scope-changed indicator (S:C) suggests the traversal can reach file system paths outside the application's own sandbox, potentially touching OS-level or adjacent service directories. No CPE strings were provided in the intelligence data; affected versions are confirmed below build 4820 per the vendor advisory.
RemediationAI
Upgrade ManageEngine M365 Manager Plus and M365 Security Plus to build 4820 or later, as released by Zohocorp. The vendor advisory at https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-16053.html provides update instructions. As a compensating control prior to patching, restrict access to the Exchange Online backup module to the minimum set of privileged administrator accounts, reducing the attack surface from general low-privilege users. Additionally, network-level controls (firewall rules or VPN-only access) can limit exposure to internal trusted networks only - note this does not eliminate risk from insider threats or compromised low-privilege accounts. Audit backup module activity logs for unusual path parameters containing traversal sequences ('../', '%2e%2e') as a detection measure.
Multiple Zoho ManageEngine on-premise products allow unauthenticated remote code execution through SAML SSO functionalit
Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remot
The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and e
Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers
ZOHO ManageEngine OpManager 11.5 build 11600 and earlier uses a hardcoded password of "plugin" for the IntegrationUser a
PGSQL:SubmitQuery.do in ZOHO ManageEngine OpManager 11.6, 11.5, and earlier allows remote administrators to bypass SQL q
Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8
ZOHO ManageEngine EventLog Analyzer 10.6 build 10060 and earlier allows remote attackers to bypass intended restrictions
Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows rem
Directory traversal vulnerability in the com.me.opmanager.extranet.remote.communication.fw.fe.FileCollector servlet in Z
SQL injection vulnerability in the LinkViewFetchServlet servlet in ManageEngine Desktop Central (DC) and Desktop Central
The ManageEngine ServiceDesk 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the path
Same weakness CWE-23 – Relative Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today