CVE-2026-15358: ManageEngine OpManager Path Traversal Flaw

CVE-2026-15358 Overview

CVE-2026-15358 is an unauthenticated path traversal vulnerability affecting ZohoCorp ManageEngine OpManager and Network Configuration Manager. Versions prior to 12.8.671 allow remote attackers to access files outside intended directories without authentication. The flaw is classified under [CWE-428] (Unquoted Search Path or Element) and is exploitable over the network without user interaction. ZohoCorp addressed the issue in build 12.8.671.

Critical Impact
An unauthenticated remote attacker can traverse the file system to read sensitive files on affected ManageEngine OpManager and Network Configuration Manager deployments, exposing configuration data and credentials.

Affected Products

ZohoCorp ManageEngine OpManager versions before 12.8.671
ZohoCorp ManageEngine Network Configuration Manager versions before 12.8.671
Associated ITOM suite components sharing the vulnerable codebase

Discovery Timeline

2026-09-23 - CVE-2026-15358 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-15358

Vulnerability Analysis

The vulnerability enables directory traversal against ManageEngine OpManager and Network Configuration Manager web interfaces. An attacker crafts an HTTP request containing traversal sequences to reference files outside the application's designated content directory. Because no authentication is required, exposure is limited only by network reachability of the management console.

Successful exploitation exposes the confidentiality of files readable by the ManageEngine service account. This can include configuration files, device backups, credential stores, and log data used by the network monitoring platform. The integrity and availability of the host remain intact according to the CVSS impact metrics.

Administrators frequently deploy OpManager and Network Configuration Manager with broad visibility into network infrastructure. File disclosure from these systems can expose SNMP community strings, SSH keys, and device configuration backups useful for lateral movement.

Root Cause

The root cause is insufficient validation of user-supplied path components in an HTTP endpoint accessible without authentication. The application resolves file paths without canonicalization or containment checks, allowing ../ sequences to escape the intended base directory. This aligns with the [CWE-428] weakness classification cited by the vendor advisory.

Attack Vector

Exploitation requires only network access to the ManageEngine web console, typically on TCP port 8060 or 8080. An attacker submits a crafted request with traversal sequences in a vulnerable parameter to retrieve arbitrary files. No credentials, prior access, or user interaction is required. Refer to the ManageEngine Security Advisory CVE-2026-15358 for vendor-provided technical context.

No verified proof-of-concept code is publicly available at the time of publication. The vulnerability mechanism follows the standard path traversal pattern where request-supplied path components are concatenated with a server-side base directory and passed to file read routines without validation.

Detection Methods for CVE-2026-15358

Indicators of Compromise

HTTP requests to OpManager or Network Configuration Manager endpoints containing ../, ..%2f, or ..%5c sequences in query parameters or URL paths
Unauthenticated GET requests returning responses referencing files outside the application web root such as /etc/passwd, web.xml, or device configuration backups
Anomalous file read activity by the ManageEngine service account touching paths outside the standard installation directory
Outbound connections from ManageEngine servers to attacker-controlled infrastructure following suspicious file access

Detection Strategies

Deploy web application firewall rules that block traversal patterns targeting ManageEngine console URLs
Enable verbose HTTP access logging on the ManageEngine web server and alert on encoded traversal tokens
Correlate high-volume unauthenticated requests to the management console with subsequent authentication anomalies on managed devices

Monitoring Recommendations

Baseline normal request patterns to the OpManager and Network Configuration Manager consoles and alert on deviations
Monitor file integrity for sensitive files referenced by the ManageEngine service account
Review NetFlow and firewall logs for management console access from unexpected source addresses

How to Mitigate CVE-2026-15358

Immediate Actions Required

Upgrade ManageEngine OpManager and Network Configuration Manager to version 12.8.671 or later
Restrict network access to management console ports so only administrative subnets can reach the web interface
Rotate credentials and SSH keys that may have been retrievable through device configuration backups stored on the platform
Review web server access logs for traversal patterns preceding the patch date

Patch Information

ZohoCorp resolved CVE-2026-15358 in ManageEngine OpManager and Network Configuration Manager build 12.8.671. Apply the vendor-supplied service pack from the ManageEngine Security Advisory CVE-2026-15358. Verify the build number in the console after upgrade to confirm remediation.

Workarounds

Place the ManageEngine console behind a reverse proxy or VPN that enforces authentication before the application layer
Apply web application firewall signatures that reject path traversal encodings on all requests to the console
Segment the ManageEngine host from general user networks and permit inbound traffic only from administrator jump hosts

bash

# Example: restrict inbound access to the OpManager console using iptables
iptables -A INPUT -p tcp --dport 8060 -s 10.10.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8060 -j DROP