CVE-2026-16053 HIGH

CVE-2026-16053: Path Traversal

Vendor Zohocorp
Product ManageEngine M365 Manager Plus
Weakness CWE-23
Published August 11, 2026
Last update August 11, 2026
View on NVD All CVEs

CVSS base score

8.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H

What the vulnerability does

01Description

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.

Key dates

02Disclosure timeline

August 11, 2026 CVE published
August 11, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-8464 Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.9.0 - Directory Traversal via `wpcf7_guest_user_id` Cookie CVE-2025-2056 WP Ghost <= 5.4.01 - Unauthenticated Limited File Read CVE-2024-50453 WordPress The Pack Elementor addons plugin <= 2.0.9 - Local File Inclusion vulnerability CVE-2025-2007 Import Export Suite for CSV and XML Datafeed <= 7.19 - Authenticated (Subscriber+) Arbitrary File Deletion CVE-2025-0822 Bit Assist <= 1.5.2 - Path Traversal to Authenticated (Subscriber+) Arbitrary File Read via fileID Parameter