CVE-2020-12116: Zoho ManageEngine OpManager path traversal allows unauthenticated file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable arbitrary file read with a very high EPSS score, though not in KEV and with no confirmed public exploit in this record.

What it is

Zoho ManageEngine OpManager builds before 124196 (Stable) and before 125125 (Released) are vulnerable to path traversal (CWE-22). A crafted request lets an unauthenticated attacker read arbitrary files on the server. Because no credentials or user interaction are required and the flaw exposes file contents, it is a serious information-disclosure risk for internet-facing deployments.

Impact

An attacker gains read access to arbitrary files on the OpManager server, which can expose configuration data, credentials and other sensitive content. There is no integrity or availability impact per the CVSS vector; the loss is confidentiality only.

Attack surface

Reachable over the network via HTTP requests to the OpManager service, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are needed, so any host that can reach the web interface can attempt it.

Exploitation

The record is not listed in CISA KEV and documents no ransomware use, but EPSS is very high (0.974 probability over 30 days, 99.9th percentile), indicating strong likelihood of attempted exploitation. All references are vendor advisories, so no public exploit code is confirmed by this record.

What to do

• Upgrade OpManager to Stable build 124196 or later, or Released build 125125 or later, per the vendor read-me.
• Restrict network access to the OpManager web interface to trusted management networks or VPN rather than exposing it to the internet.
• Place the service behind a reverse proxy or WAF with path traversal normalization and blocking rules.
• Rotate any credentials or secrets stored in files on the OpManager host that may have been exposed.
• Monitor vendor advisories for follow-up fixes if the deployed build cannot be upgraded immediately.

Detection

• Review web server and OpManager logs for requests containing traversal sequences such as ../ or encoded variants (..%2f, %2e%2e/) targeting file paths.
• Alert on HTTP requests to OpManager endpoints that reference absolute or system file paths outside expected web content directories.
• Baseline normal OpManager request patterns and flag anomalous single-request file-path access from unfamiliar source IPs.
• Check for outbound exfiltration or unusual reads of sensitive files (configuration, credential stores) on the OpManager host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.