CVE-2026-16053: Authenticated path traversal vulnerability in M365 Manager Plus and M365 Security Plus

Details

CVE-2026-16053 refers to an authenticated path traversal vulnerability in the Exchange Online backup module that could let an attacker delete arbitrary files on the server.

Impact

An authenticated attacker could exploit this vulnerability to delete arbitrary files on the server resulting in a loss of data integrity and availability of services.

Fix

The issue has been resolved by implementing path validation to ensure that only valid file and folder paths are processed, preventing path traversal and arbitrary file deletion.

Steps to update

Download and apply the latest service pack from the following links:

• M365 Manager Plus: https://www.manageengine.com/microsoft-365-management-reporting/service-pack.html
• M365 Security Plus: https://www.manageengine.com/microsoft-365-security-protection/service-pack.html

Acknowledgements

This issue was reported by Zewei Zhang from NSFOCUS TIANJI Lab through the Zoho BugBounty program.

Please contact product support at the mail addresses mentioned below for further assistance. You can also contact our security team.

• M365 Manager Plus support: m365managerplus-support@manageengine.com
• M365 Security Plus support: m365securityplus-support@manageengine.com