Quick answers
- Is CVE-2026-16053 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-16053 being exploited in the wild.
- How severe is CVE-2026-16053?
- High severity, with a CVSS score of 8.5, published 11 August 2026.
- Which products and versions are affected?
- Zoho ManageEngine M365 Manager Plus below 4820; Zoho ManageEngine M365 Security Plus below 4820.
- Is there a fix for CVE-2026-16053?
- A patch was published on 2026-07-13: Fixed version 4820 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-16053 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-16053?
- Check whether you run Zoho ManageEngine M365 Manager Plus or Zoho ManageEngine M365 Security Plus at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
CVE-2026-16053 is an authenticated path traversal vulnerability in the Exchange Online backup module of ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820. The vulnerability stems from insufficient path validation when processing file and folder paths, allowing an authenticated attacker to traverse the file system and delete arbitrary files. Attack requires valid authentication credentials but no elevated privileges. The impact is loss of data integrity and service availability. The vendor has patched the issue by implementing proper path validation and restricting file operations to valid paths only.
Affected products
- Zoho ManageEngine M365 Manager Plus below 4820
- Zoho ManageEngine M365 Security Plus below 4820
Timeline
- 2026-08-11: disclosed
- 2026-07-13: patched: Fixed version 4820 released