CVE-2023-47211: ManageEngine OpManager uploadMib path traversal allows arbitrary file creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable arbitrary file creation with a high EPSS score and public exploit detail, though not in KEV.

What it is

The uploadMib function in ManageEngine OpManager 12.7.258 does not properly validate paths, so a crafted HTTP request carrying a malicious MIB file can write files to arbitrary locations. Because the write is unauthenticated and can reach outside the application's intended directory, it is a serious integrity risk for exposed instances.

Impact

An attacker can create arbitrary files on the server, which can lead to code execution or configuration tampering depending on what the attacker can write and where. The CVSS vector shows high integrity impact with no confidentiality or availability impact.

Attack surface

Reachable over the network through the uploadMib HTTP endpoint with no authentication and no user interaction required, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The description confirms the trigger is a malicious MIB file sent in a request.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.47 (98.8th percentile) and the Talos reference is tagged Exploit, indicating public exploit detail exists. No ransomware usage is documented.

What to do

• Apply the vendor fix referenced in the ManageEngine advisory for CVE-2023-47211.
• Restrict network access to the OpManager uploadMib endpoint to trusted management networks only.
• Run the product with least privilege so arbitrary file writes cannot reach sensitive paths.
• Audit file system changes in and around the OpManager installation for unexpected files.
• Monitor vendor advisories for the other listed ManageEngine products sharing this code path.

Detection

• Alert on HTTP requests to the uploadMib endpoint from untrusted sources.
• Monitor for new or modified files in web-accessible and application directories.
• Inspect MIB upload payloads for traversal sequences such as ../ in filenames.
• Correlate file creation events with OpManager process activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.