CVE-2026-16053: Path Traversal in ManageEngine M365 Manager Plus and M365 Security Plus

TL;DR: The Exchange Online backup module in ManageEngine M365 Manager Plus and M365 Security Plus builds prior to 4820 accepted insufficiently validated repository paths, allowing an authenticated low-privilege operator to write backup data to arbitrary filesystem locations and read files outside the intended backup directory tree. CVE-2026-16053 was assigned CWE-23 (Path Traversal) with a CVSS 3.1 base score of 8.5 HIGH (vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H). ManageEngine released build 4820 for both products with the fix.

What happened

The Exchange Online backup module is the component in M365 Manager Plus and M365 Security Plus that ingests mailbox and mail-archive snapshots from Microsoft 365 and stores them in one of three repository types: local disk, network-attached storage, or a shared folder. When an operator initiates a backup or restore, the module takes a repository configuration string supplied either in JSON via the management console or in a saved policy and concatenates it directly into the base backup directory before opening file handles for writes.

The path join did not canonicalize or validate against directory traversal. A repository path of the form /../../etc/backup_repo ascending out of the configured base put the open file handle on an operating-system directory the operator could not normally reach. On Linux deployments the traversal landed on the service account's filesystem context. On Windows deployments the same sequence wrote through to system locations if the service account held write permission there. Because the backup pipeline runs as the ManageEngine application service user, the reachable surface was wherever that account could write.

The wire and console flow makes this reachable without local access. An operator controlling a mailbox configured for backup could submit a repository path through the M365 Manager Plus REST endpoint that the management console uses for backup scheduling. The validation layer checked only that the path started with the configured root, not that it resolved inside it. This is a classic CWE-23 sanitization hole: the check assumed string prefix equality preserves directory containment, which fails once separators and parent-directory traversal appear in the supplied string.

Who is affected

Both ManageEngine M365 Manager Plus and M365 Security Plus in builds prior to 4820 are affected. The products run as on-premises Java application servers installed by IT operations teams in Microsoft 365 tenant environments. Deployment scale is enterprise: M365 Manager Plus targets Microsoft 365 reporting, auditing, management, and automation with 700 plus built-in reports, role-based delegation, and Exchange Online backup and restore as a packaged feature. M365 Security Plus is the companion auditing and monitoring suite with Exchange Online incremental backup offered as an add-on module. Licenses are per mailbox, so the natural install base is mid-to-large Microsoft 365 tenants that want consolidated M365 visibility beyond what the native Microsoft admin centers provide.

The vulnerable code path is specifically the backup and restore module. Environments never configuring Exchange Online backup through either product are not exposed to this path. The management console, reporting, and audit modules operate independently of the repository write logic.

What to do

Upgrade both M365 Manager Plus and M365 Security Plus to build 4820 or later. ManageEngine published the fixed build through the standard product update channel; the update applies the path canonicalization that the vulnerable versions omitted. Download links and installation notes are in the ManageEngine security advisory referenced below.

Until the upgrade lands, restrict who can configure backup repositories in both consoles. The vulnerability requires authenticated low-privilege operator access, so tightening the role-based delegation so that only backup administrators can set or modify repository paths closes the practical abuse channel. Audit existing repository configurations in both products for any entries that point outside the intended base directory, since a prior traversing write could already have landed files in unexpected locations.

Check the service account context that the ManageEngine application user runs under. If that account has broad filesystem write rights, a traversing write had a larger reachable surface. Tightening the account to least-privilege narrows the blast radius even on the vulnerable build.

Why it matters

The CVSS 3.1 score sits at 8.5 HIGH, with the Scope marked Changed because the traversal escapes the backup module's authority boundary into the host filesystem. The impact triad breaks down as Confidentiality None, Integrity Low, and Availability High. Availability is rated high because a traversing write can land backup archive data on system or application paths the service depends on, corrupting them and degrading the availability of both the backup module itself and anything sharing the affected directory. Integrity is low because the traversal lets the operator write new files into unexpected locations but does not by itself modify existing files in place.

Reference status: at time of writing the CVE exists in the National Vulnerability Database with the CVSS vector above and the ManageEngine advisory linked as a reference. The CVE is not currently listed on the CISA Known Exploited Vulnerabilities catalog. ManageEngine has shipped a fix, and the advisory names build 4820 as the patched release for both products. The common weakness is CWE-23, path traversal, one of the highest-frequency weakness categories tracked year over year.

The control this exploit relies on is operator authentication plus the ability to submit backup repository configuration. In environments where M365 Manager Plus or M365 Security Plus is configured with broad operator access, a single compromised operator credential becomes a path to host filesystem exposure. The same tenant environments that justify buying a dedicated M365 reporting and backup product tend to be large Microsoft 365 estates, which means a large mailbox footprint and a large operator roster. The risk surface scales with that roster.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-16053
• ManageEngine security advisory: https://www.manageengine.com/security/advisories/cve-2026-16053.html
• Canonical URL: https://hol.org/blog/cve-2026-16053-manageengine-m365-backup-path-traversal