# CVE-2026-15358: ManageEngine OpManager path traversal in Smart Update Manager

Source: https://junglewise.ai/threats/cve-2026-15358-zohocorp-manageengine-opmanager-and-network-configuration-manager  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-15358 · Severity: high · CVSS 7.5 · Published 2026-09-23

ManageEngine OpManager and Network Configuration Manager are network monitoring and management tools used by IT operations teams to oversee infrastructure. A path traversal vulnerability in the legacy Smart Update Manager on probe installations could allow unauthorized access to files outside intended directories, potentially exposing sensitive configuration data or enabling system compromise. The issue affects multiple product editions with versions before 12.8.671 and has been patched.

Technologies: [Zoho ManageEngine OpManager Enterprise Edition](https://junglewise.ai/threats/technologies/manageengine-opmanager-enterprise-edition), [Zoho ManageEngine OpManager Nexus Enterprise Edition](https://junglewise.ai/threats/technologies/manageengine-opmanager-nexus-enterprise-edition). Vendors: [Zoho](https://junglewise.ai/threats/vendors/zoho).

## Quick answers

**Is CVE-2026-15358 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15358 being exploited in the wild.

**How severe is CVE-2026-15358?** High severity, with a CVSS score of 7.5, published 23 September 2026.

**Which products and versions are affected?** Zoho ManageEngine Network Configuration Manager Enterprise Edition 12.8.718 to 12.8.737; Zoho ManageEngine OpManager Enterprise Edition 12.8.670 and below; Zoho ManageEngine OpManager MSP 12.9.000, 12.9.100 to 12.9.106; Zoho ManageEngine OpManager Nexus Enterprise Edition 12.8.676 to 12.8.708.

**Is there a fix for CVE-2026-15358?** A patch was published on 2026-07-10: OpManager Enterprise and NCM Enterprise patched (12.8.671) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15358 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-15358?** Check whether you run Zoho ManageEngine Network Configuration Manager Enterprise Edition, Zoho ManageEngine OpManager Enterprise Edition, Zoho ManageEngine OpManager MSP or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unauthorized path traversal vulnerability exists in the legacy Smart Update Manager component on Probe installations in OpManager and Network Configuration Manager. The vulnerability allows attackers to access files outside restricted directories without authentication, potentially leading to information disclosure or further system compromise. Patches are available with fixed versions 12.8.671 (OpManager Enterprise/NCM Enterprise), 12.8.709 (OpManager Nexus), 12.8.738 (OpManager MSP), and 12.9.107 (later releases).

## Affected products

- Zoho ManageEngine OpManager Enterprise Edition 12.8.670 and below
- Zoho ManageEngine OpManager Nexus Enterprise Edition 12.8.676 to 12.8.708
- Zoho ManageEngine Network Configuration Manager Enterprise Edition 12.8.718 to 12.8.737
- Zoho ManageEngine OpManager MSP 12.9.000, 12.9.100 to 12.9.106

## Timeline

- 2026-09-23: disclosed
- 2026-07-10: patched: OpManager Enterprise and NCM Enterprise patched (12.8.671)
- 2026-07-21: patched: OpManager Nexus patched (12.8.709)
- 2026-07-10: patched: OpManager MSP patched (12.8.738)
- 2026-07-11: patched: Later releases patched (12.9.107)

## References

- [https://www.manageengine.com/itom/advisory/cve-2026-15358.html](https://www.manageengine.com/itom/advisory/cve-2026-15358.html)

## Related threats

- [Zoho ManageEngine OpManager and Firewall Analyzer credential exposure in syslog collector](https://junglewise.ai/threats/cve-2026-76980-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager and Firewall Analyzer XML injection in Rule Tracking](https://junglewise.ai/threats/cve-2026-76979-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager and Firewall Analyzer command injection in Diagnose Settings](https://junglewise.ai/threats/cve-2026-76978-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)
- [Zoho ManageEngine OpManager MSP remote code execution in Notification Profile](https://junglewise.ai/threats/cve-2026-19599-zohocorp-manageengine-opmanager-msp-versions-12-8-709-and-below)
- [Zoho ManageEngine OpManager and Firewall Analyzer access control bypass](https://junglewise.ai/threats/cve-2026-84791-zohocorp-manageengine-opmanager-and-firewall-analyzer-versions-12)