CVE-2021-20078: ManageEngine OpManager path traversal in Spark gateway allows remote directory deletion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 9.1 with no authentication or user interaction required, high EPSS, and public exploit references make this a top remediation priority despite no KEV listing.

What it is

ManageEngine OpManager builds below 125346 contain a path traversal flaw (CWE-22) in the Spark gateway component. A remote, unauthenticated attacker can abuse it to delete arbitrary directories on the host operating system, causing a denial of service. The flaw is rated critical (CVSS 9.1) because it needs no privileges or user interaction and has high integrity and availability impact.

Impact

An attacker can delete any directory on the underlying OS, which can destroy application data and configuration and take the OpManager service down. The result is a remote denial of service with potential loss of monitoring data.

Attack surface

Reachable over the network through the Spark gateway component, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication and no user interaction are required.

Exploitation

Not listed in CISA KEV and no ransomware use is documented, but EPSS is high (0.6037, 99.1st percentile) and both references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade ManageEngine OpManager to build 125346 or later, which is the fixed build named in the advisory.
• If immediate patching is not possible, restrict network access to the Spark gateway component to trusted hosts only.
• Segment the OpManager server so a compromise cannot reach unrelated systems or shared storage.
• Verify backups of OpManager configuration and data are current and restorable before applying changes.
• Monitor vendor advisories for any follow-up fixes or updated build guidance.

Detection

• Alert on unexpected deletion or mass file-removal activity in OpManager install and data directories.
• Monitor Spark gateway request logs for path traversal patterns such as ../ sequences or absolute paths.
• Watch for sudden OpManager service stops, crashes or missing directories that follow unusual gateway traffic.
• Correlate network connections to the Spark gateway port from untrusted sources with subsequent file system changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.