CVE-2026-16053

Executive Summary

CVE-2026-16053 is an authenticated path traversal vulnerability (CWE-23) affecting Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus in versions below 4820. The flaw resides in the Exchange Online backup module and allows an authenticated attacker to manipulate file path inputs to traverse outside the intended directory structure. Successful exploitation results in high availability impact (CVSS base score 8.5) due to the ability to write to arbitrary locations on the underlying filesystem, potentially corrupting backup data, overwriting critical files, or causing denial-of-service conditions. As of this report, no public exploit code has been observed, but the vulnerability remains unpatched in environments running versions prior to 4820.

Technical Analysis

Vulnerability Class & Mechanism
CVE-2026-16053 is a relative path traversal vulnerability (CWE-23) — a subclass of canonical path traversal (CWE-22). The flaw specifically exists within the Exchange Online backup module of M365 Manager Plus and M365 Security Plus. This module handles retrieval, storage, and restoration of mailbox data from Microsoft 365 Exchange Online via integration with the Microsoft Graph API or EWS (Exchange Web Services).

Attack Surface
The affected module processes user-supplied parameters that influence file paths used in backup operations. These parameters likely include mailbox identifiers, backup job names, or restore destination paths. The vulnerability is triggered when the application fails to properly sanitize or normalize user input before concatenating it with a base directory path. Because the attack requires an authenticated session (CVSS PR:L), the attack surface is limited to users with legitimate access to the M365 Manager Plus or M365 Security Plus web interface — typically IT administrators or helpdesk personnel.

Code-Level Explanation (Inferred from Class)
While the specific vulnerable function is not disclosed, the typical pattern for such flaws is:

1. The application receives a user-supplied parameter (e.g., a backup job name or mailbox alias).
2. The parameter is concatenated onto a base path like C:\Backups\ExchangeOnline\{user_input} or /opt/manageengine/m365/backups/{user_input}.
3. The resulting path is passed to file I/O functions (e.g., File.WriteAllBytes(), FileStream(), or equivalent Java/.NET methods) without passing the path through Path.GetFullPath() and verifying it stays within the intended root.
4. An attacker submits input containing ../ or ..\ sequences (e.g., ../../../Windows/System32/config), causing the path resolution to escape the backup directory.

Affected Products Context
M365 Manager Plus provides reporting, monitoring, and management for Microsoft 365 environments. M365 Security Plus extends this with security auditing and threat detection. Both products run as on-premises Java-based (primarily) web applications managing mailbox backups, making the Exchange Online backup module a trusted component with elevated privileges on the host system.

CVSS Subscore Analysis

• AV:N — The vulnerability is remotely exploitable over the network.
• AC:L — No special conditions; requires only standard authentication.
• PR:L — Requires low-privilege authenticated access (a standard user with login credentials).
• UI:N — No user interaction required.
• S:C — Scope changed; the impact extends beyond the vulnerable component to the host filesystem.
• I:L — Limited integrity impact; attacker can overwrite/modify limited files.
• A:H — High availability impact; arbitrary file writes can corrupt backup repositories or overwrite critical system files causing service disruption.

Exploitation Scenarios

Note: No public PoC is available for CVE-2026-16053. The attack chain below is inferred from the vulnerability class (CWE-23) and the affected component description. Specific parameter names, URLs, and payload structures are NOT disclosed in available data and should NOT be assumed beyond the class-level description.

Scenario 1 — Backup Repository Corruption (Availability Focus)

1. Reconnaissance: An authenticated user (e.g., a helpdesk operator with standard credentials) enumerates the M365 Manager Plus web application, identifies the Exchange Online backup module, and reviews the available backup job creation/management forms.
2. Triggering the Flaw: The attacker creates or modifies a backup job, injecting path traversal sequences into a filename or mailbox identifier field. For example, a mailbox field might accept a value like ../../../../Program Files/ManageEngine/M365ManagerPlus/conf — if the application constructs a backup path using this input without validation.
3. Payload/Execution: The attacker leverages the path traversal to write malicious content (or empty/corrupt files) to a critical system directory. Because the application runs with administrator or SYSTEM privileges (typical for backup services), files can be written to protected locations.
4. Post-Exploitation Impact: The attacker overwrites configuration files, corrupts the backup index, or fills the disk with junk data, causing the service to fail. In a targeted scenario, overwriting a JAR or DLL file could lead to remote code execution under certain conditions (not confirmed for this CVE).

Scenario 2 — Multi-Tenant or Shared-Environment Cross-Tenant Data Access

1. Reconnaissance: In an MSP (Managed Service Provider) deployment, the attacker identifies that the same M365 Manager Plus instance manages backups for multiple client tenants.
2. Triggering: The attacker submits a restore request with a path traversal payload targeting another tenant's backup directory.
3. Payload/Execution: The path traversal allows the attacker to read or manipulate another tenant's backup files, potentially extracting sensitive email data.
4. Post-Exploitation: Exfiltration of another tenant's mailbox data leads to data breach. Note: Availability impact (A:H) is dominant in the CVSS vector, but integrity impact may manifest in multi-tenant scenarios.

Scenario 3 — Web Shell Deployment (Theoretical, Not Confirmed)

1. Reconnaissance: Attacker maps the web application's directory structure via error messages or directory listing.
2. Triggering: Victim traverses to a web-accessible directory (e.g., /webapps/ROOT/ for Java-based ManageEngine products) and writes a JSP file using a traversal payload in a backup filename.
3. Payload/Execution: The attacker requests the uploaded file over HTTP; if the web server resolves it, arbitrary code execution occurs.
4. Post-Exploitation: Full host compromise. This scenario is plausible but unverified for CVE-2026-16053 due to lack of technical details about writable locations.

Impact Assessment

Business Impact

• High availability impact (CVSS A:H): An attacker can corrupt the entire backup repository for Exchange Online mailboxes. In ransomware scenarios, attackers commonly target backup infrastructure to eliminate recovery options, increasing the severity of a parallel primary attack.
• Integrity impact (CVSS I:L): Limited ability to modify files outside the backup directory; however, even limited file writes to a server running with elevated privileges can enable configuration tampering.
• Confidentiality impact (CVSS C:N): No direct confidentiality impact per the CVSS vector; however, in multi-tenant deployments, path traversal may enable reading backup files belonging to other tenants.

Affected Systems

• ManageEngine M365 Manager Plus — versions below 4820
• ManageEngine M365 Security Plus — versions below 4820
• Both products are typically deployed on Windows Server (primary) or Linux (secondary support).

Blast Radius

• Direct: The host operating system of the ManageEngine instance; all mailboxes managed by that instance.
• Indirect: Organizations relying on the M365 backup for business continuity and compliance (e.g., legal hold, e-discovery). Backup failure violates SLAs, compliance frameworks (GDPR, HIPAA, SOX), and internal retention policies.
• Lateral Movement: Compromise of the backup server often yields credentials to the Microsoft 365 tenant (via Graph API tokens or EWS), enabling mailbox access, additional persistence, or tenant-wide compromise.

CVSS Rationale
The CVSS:3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H reflects a remote, low-complexity, authenticated attack with scope change and high availability impact. The high availability component (8.5 base score) underscores the criticality of backup infrastructure integrity.

Detection Guidance

Sigma Rule

title: ManageEngine M365 Path Traversal in Exchange Online Backup
id: 9f2c3a11-6b9e-4d7c-8e1f-3c5b8a2d4f6a
status: experimental
description: Detects path traversal indicators in ManageEngine M365 Manager Plus/Security Plus backup module requests
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-16053
author: Valtersit Threat Intel
date: 2025/01/15
logsource:
    category: webserver
    product: iis
    service: http
detection:
    selection_traversal:
        cs-uri-query|contains:
            - '..%2f'
            - '..%5c'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
    selection_backup_module:
        cs-uri-stem|contains:
            - '/M365ManagerPlus/'
            - '/M365SecurityPlus/'
        cs-uri-stem|contains|all:
            - 'backup'
            - 'exchange'
    condition: selection_traversal and selection_backup_module
falsepositives:
    - Legitimate URL encoding of filenames containing dots or slashes (rare)
level: high

YARA Rule

rule ManageEngine_M365_PathTraversal_CVE_2026_16053
{
    meta:
        author = "Valtersit Threat Intel"
        date = "2025-01-15"
        description = "Detects path traversal payloads in M365 Manager Plus/Security Plus web request logs"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-16053"
        cve = "CVE-2026-16053"
        severity = "high"

    strings:
        $traversal1 = "..%2f" ascii nocase
        $traversal2 = "..%5c" ascii nocase
        $traversal3 = "%2e%2e%2f" ascii nocase
        $traversal4 = "%2e%2e%5c" ascii nocase
        $traversal5 = "../" ascii nocase
        $traversal6 = "..\\" ascii nocase
        $module1 = "backup" ascii nocase
        $module2 = "exchangeonline" ascii nocase
        $module3 = "mailbox" ascii nocase

    condition:
        any of ($traversal*) and any of ($module*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2026-16053 ManageEngine M365 Backup Path Traversal Attempt";
    flow:to_server,established;
    content:"/M365", fast_pattern, nocase;
    content:"backup", nocase;
    content:"exchange", nocase;
    pcre:"/(?:\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e%5c|\.\.\/|\.\.\\)/i";
    classtype:attempted-admin;
    reference:cve,2026-16053;
    sid:100026053;
    rev:1;
    metadata:created_at 2025_01_15, updated_at 2025_01_15;
)

Elastic Detection

sequence by host.name, source.ip with maxspan=5m
  [ network where event.category == "web" and
    url.path : "/M365*" and
    url.path : "*backup*" and
    url.path : "*exchange*" and
    (url.query : "*..%2f*" or url.query : "*..%5c*" or
     url.query : "*%2e%2e%2f*" or url.query : "*%2e%2e%5c*" or
     url.query : "*../*" or url.query : "*..\\*") ]
  [ file where event.category == "file" and
    event.action in ("write", "create", "modify") and
    file.path : ("*\\\\..\\\\*", "*\\/../\\/*") ]

Splunk SPL Query

index=web sourcetype=iis OR sourcetype=apache
| search uri_path="/M365*" AND uri_path="*backup*" AND uri_path="*exchange*" 
| search uri_query="*..%2f*" OR uri_query="*..%5c*" OR 
        uri_query="*%2e%2e%2f*" OR uri_query="*%2e%2e%5c*" OR
        uri_query="*../*" OR uri_query="*..\\*"
| eval cve="CVE-2026-16053"
| table _time, src_ip, dest_ip, uri_path, uri_query, user_agent, status
| sort -_time

Wazuh OSSEC Rule

<rule id="160053" level="12">
  <decoded_as>web</decoded_as>
  <field name="url">\./</field>
  <description>ManageEngine M365 backup path traversal attempt (CVE-2026-16053)</description>
  <group>web_application_attack,path_traversal,cve_2026_16053,</group>
  <regex>\.\./|\.\.\\|\.\.%2f|\.\.%5c|%2e%2e%2f|%2e%2e%5c</regex>
  <field name="url">backup</field>
  <field name="url">exchange</field>
  <mitre>
    <id>T1190</id>
  </mitre>
  <info type="cve" ref="https://nvd.nist.gov/vuln/detail/CVE-2026-16053" />
</rule>

Mitigation & Patch Guidance

Patch Status: UNPATCHED (0/4 confidence)
No official advisory, patch binary, or hotfix has been confirmed from any tracked source at the time of this report. The fixed version is 4820 per the NVD description ("versions below 4820 are affected"), but the vendor's advisory URL is unavailable.

IMPORTANT CAVEAT: While the description states versions below 4820 are affected, this does NOT guarantee that a patch is publicly available. Treat 4820 as the target version and verify directly with Zoho/ManageEngine support channels.

1. Immediate Mitigations

1. Restrict Access: Limit access to the M365 Manager Plus / M365 Security Plus web interface to a trusted network segment (e.g., VPN or dedicated management VLAN). Apply source IP allowlisting at the firewall or reverse proxy level.
2. Disable Backup Module Temporarily: If the Exchange Online backup module is non-essential and can be suspended, disable it via the product's configuration to reduce the attack surface.
3. Apply Least Privilege: Review user accounts with access to the backup module. Remove access for users who do not require it. Ensure the application service account runs with minimal required OS privileges (avoid LocalSystem/root where possible).
4. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing path traversal patterns (../, ..%2f, %2e%2e%2f, etc.) that target the M365 application. Use the Suricata or Sigma rules provided above as reference logic.
5. Monitor Backup Integrity: Perform daily checks on the backup repository for unexpected file modifications, deletions, or additions. Verify checksums of critical application binaries (JARs, EXEs, DLLs).

2. Patch/Upgrade Steps

1. Verify Current Version: Log into the M365 Manager Plus / M365 Security Plus administration console → About/Help section to confirm the installed build number.
2. Contact Vendor: Open a support ticket with Zoho/ManageEngine, referencing CVE-2026-16053, and request the fix for build 4820 or later.
3. Download and Test: Obtain the latest build from the official ManageEngine download portal. Test in a staging environment that mirrors production (same OS, same M365 tenant integration).
4. Schedule Upgrade: Apply the upgrade during a maintenance window. Back up the current configuration (server.xml, database files, and keystore) before proceeding.
5. Validate: After upgrade, verify the build number, re-run backup and restore functions, and confirm the path traversal payload no longer succeeds.

3. Long-Term Hardening

• Network Segmentation: Place the ManageEngine instance in a separate security zone from domain controllers and other Tier-0/1 assets.
• Credential Hygiene: Rotate the service account credential and the Microsoft 365 integrated app token/signing credentials used by the backup module.
• File Integrity Monitoring (FIM): Deploy FIM (e.g., Wazuh FIM, Tripwire, OSSEC) on the Program Files\ManageEngine and \ProgramData\ManageEngine directories.
• Backup of Backups: Implement a 3-2-1 backup strategy to ensure a secondary offline copy of M365 mailbox data exists independent of this product.
• Update Management Cadence: Monitor ManageEngine's advisory page and subscribe to their security announcements; apply future upgrades more promptly given this class of vuln in backup tooling carries high business risk.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16053 — Official CVE description, CVSS vector, and affected product details.
2. ManageEngine Security Advisory Portal: https://www.manageengine.com/security/advisory.html — Monitor for the official advisory for CVE-2026-16053 when published by Zoho.
3. ManageEngine M365 Manager Plus Product Page: https://www.manageengine.com/microsoft-365-management/ — Product documentation for version identification, upgrade procedures.
4. ManageEngine M365 Security Plus Product Page: https://www.manageengine.com/microsoft-365-security/ — Product documentation and security supplements.
5. CWE-23 Reference: https://cwe.mitre.org/data/definitions/23.html — Relative Path Traversal weakness description and common mitigation patterns.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence:
No known threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-16053 as of this writing. The vulnerability is not listed on CISA KEV. However, historical context from 2020-2023 shows multiple ManageEngine vulnerabilities (e.g., CVE-2021-40859, CVE-2022-47966) being actively exploited by APT groups shortly after disclosure. Given the high availability impact and authenticated nature of this flaw, organizations should treat it as a priority for patching even absent public exploit code.