Authenticated Path Traversal in ManageEngine M365 Backup Module

CVE-2026-16053 is an authenticated path traversal vulnerability affecting Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820. This vulnerability exists in the Exchange Online backup module and allows an authenticated attacker to traverse the file system and access unauthorized files. Organizations relying on ManageEngine for Microsoft 365 backup and security management are directly impacted, particularly those who have not patched to version 4820 or later. Path traversal vulnerabilities are particularly dangerous in backup systems because they can expose sensitive configuration files, credentials, and backup data that contain critical organizational information.

While this CVE does not currently map to specific MITRE ATT&CK techniques, Casky's Claude AI-powered analysis can detect path traversal attack patterns through behavioral anomalies in file access requests and directory enumeration attempts. Although Casky currently has zero matching skills indexed for this specific vulnerability, practitioners using the platform would benefit from monitoring for reconnaissance activity (ATT&CK T1087, T1580) where attackers probe directory structures, and credential access patterns (ATT&CK T1110) if exposed credentials are discovered through traversal. Extended reasoning capabilities would identify suspicious sequences of authenticated requests attempting to access files outside the intended backup directory, flagging deviations from normal ManageEngine operational patterns and alerting teams to potential exploitation before data exfiltration occurs.