Search
Find a vulnerability
Search criteria
2 vulnerabilities found for ManageEngine M365 Manager Plus by Zohocorp
CVE-2026-16053 (GCVE-0-2026-16053)
Vulnerability from nvd – Published: 2026-08-11 06:36 – Updated: 2026-08-11 13:22
VLAI
EPSS
VEX
Title
Path Traversal
Summary
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
Severity
8.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 13:22 UTC
CWE
- CWE-23 - Relative path traversal
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zohocorp | ManageEngine M365 Manager Plus |
Affected:
0 , < 4820
(4820)
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:*:*:*:*:*:*:*:* |
|
| Zohocorp | ManageEngine M365 Security Plus |
Affected:
0 , < 4820
(4820)
cpe:2.3:a:zohocorp:manageengine_m365_security_plus:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T13:22:13.193778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T13:22:28.668Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ManageEngine M365 Manager Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "4820",
"status": "affected",
"version": "0",
"versionType": "4820"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ManageEngine M365 Security Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "4820",
"status": "affected",
"version": "0",
"versionType": "4820"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4820",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_m365_security_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4820",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Zohocorp ManageEngine\u0026nbsp;M365 Manager Plus and M365 Security Plus versions below\u0026nbsp;4820 are affected to Authenticated Path Traversal vulnerability in\u0026nbsp;Exchange Online backup module."
}
],
"value": "Zohocorp ManageEngine\u00a0M365 Manager Plus and M365 Security Plus versions below\u00a04820 are affected to Authenticated Path Traversal vulnerability in\u00a0Exchange Online backup module."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative path traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T06:36:22.533Z",
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"shortName": "Zohocorp"
},
"references": [
{
"url": "https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-16053.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Path Traversal",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"assignerShortName": "Zohocorp",
"cveId": "CVE-2026-16053",
"datePublished": "2026-08-11T06:36:22.533Z",
"dateReserved": "2026-07-17T10:41:20.330Z",
"dateUpdated": "2026-08-11T13:22:28.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-16053 (GCVE-0-2026-16053)
Vulnerability from cvelistv5 – Published: 2026-08-11 06:36 – Updated: 2026-08-11 13:22
VLAI
EPSS
VEX
Title
Path Traversal
Summary
Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.
Severity
8.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-11 13:22 UTC
CWE
- CWE-23 - Relative path traversal
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Zohocorp | ManageEngine M365 Manager Plus |
Affected:
0 , < 4820
(4820)
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:*:*:*:*:*:*:*:* |
|
| Zohocorp | ManageEngine M365 Security Plus |
Affected:
0 , < 4820
(4820)
cpe:2.3:a:zohocorp:manageengine_m365_security_plus:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16053",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-11T13:22:13.193778Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T13:22:28.668Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "ManageEngine M365 Manager Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "4820",
"status": "affected",
"version": "0",
"versionType": "4820"
}
]
},
{
"defaultStatus": "unaffected",
"product": "ManageEngine M365 Security Plus",
"vendor": "Zohocorp",
"versions": [
{
"lessThan": "4820",
"status": "affected",
"version": "0",
"versionType": "4820"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4820",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:zohocorp:manageengine_m365_security_plus:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4820",
"versionStartIncluding": "0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "OR"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Zohocorp ManageEngine\u0026nbsp;M365 Manager Plus and M365 Security Plus versions below\u0026nbsp;4820 are affected to Authenticated Path Traversal vulnerability in\u0026nbsp;Exchange Online backup module."
}
],
"value": "Zohocorp ManageEngine\u00a0M365 Manager Plus and M365 Security Plus versions below\u00a04820 are affected to Authenticated Path Traversal vulnerability in\u00a0Exchange Online backup module."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-23",
"description": "CWE-23 Relative path traversal",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-11T06:36:22.533Z",
"orgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"shortName": "Zohocorp"
},
"references": [
{
"url": "https://www.manageengine.com/microsoft-365-management-reporting/CVE-2026-16053.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Path Traversal",
"x_generator": {
"engine": "Vulnogram 1.0.4"
}
}
},
"cveMetadata": {
"assignerOrgId": "0fc0942c-577d-436f-ae8e-945763c79b02",
"assignerShortName": "Zohocorp",
"cveId": "CVE-2026-16053",
"datePublished": "2026-08-11T06:36:22.533Z",
"dateReserved": "2026-07-17T10:41:20.330Z",
"dateUpdated": "2026-08-11T13:22:28.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}