ZohoCorp ManageEngine OpManager and Network Configuration Manager versions before 12.8.671 are affected by a path traversal flaw that allows an unauthenticated attacker to access or modify files outside the intended directory structure. The weakness is a CWE‑428 issue involving insufficient validation of file paths, which can expose sensitive configuration data or enable tampering with system files.

The vulnerability impacts both ManageEngine OpManager and ManageEngine Network Configuration Manager from ZohoCorp. All releases prior to version 12.8.671 are susceptible. Users should check the installed version and plan to upgrade to the patched release.

The CVSS score of 7.5 signifies a high severity vulnerability. The EPSS score of 1% indicates a low to moderate likelihood of exploitation in current environments. Although it is not listed in the CISA KEV catalog, the lack of authentication required for the path traversal makes the attack vector effectively remote through the web interface or API, as inferred from the description.