CVE-2026-15358 describes an unquoted search path or element vulnerability (CWE-428) in ZohoCorp's ManageEngine OpManager and Network Configuration Manager products. Versions before 12.8.671 are affected. This vulnerability allows an attacker to exploit the unquoted search path to perform unauthorized path traversal, potentially leading to unauthorized access to sensitive files or information. The vulnerability has a CVSS 3.1 score of 7.5, reflecting high severity with network attack vector and no privileges or user interaction required.

Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to files or directories by manipulating the search path. The impact is limited to confidentiality as indicated by the CVSS vector (C:H/I:N/A:N). There is no indication of integrity or availability impact. No known exploits are reported in the wild at this time.

A fixed version 12.8.671 or later should be applied to remediate this vulnerability. Since the affected versions are explicitly stated as prior to 12.8.671, upgrading to 12.8.671 or newer is recommended. No vendor advisory or patch link was provided, so confirm patch availability from ZohoCorp official sources before applying.