This vulnerability (CVE-2026-16053) is a CWE-23 relative path traversal issue in the Exchange Online backup module of Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus. It affects versions prior to 4820 and requires authentication. The vulnerability allows an attacker with valid credentials to manipulate file paths, potentially leading to unauthorized file access or modification. The CVSS v3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, required privileges, no user interaction, scope change, no confidentiality impact, limited integrity impact, and high availability impact. No official patch or vendor advisory detailing remediation is currently available.

An authenticated attacker can exploit this path traversal vulnerability to access or modify files outside the intended directory scope within the Exchange Online backup module. This can lead to integrity and availability impacts on the affected system. Confidentiality is not impacted according to the CVSS vector. The vulnerability could disrupt backup operations or allow unauthorized changes to backup data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for updates from Zohocorp and apply patches promptly once available. Until then, restrict access to the affected module to trusted users only and consider additional access controls to limit potential exploitation.