CVE-2016-6600: Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1...

Security readout for executives and security teams

CVE-2016-6600 lets a remote attacker abuse WebNMS Framework file upload handling to place and execute JSP files outside the intended upload path. For a business, a reachable affected server could become an application-level compromise point. The source bundle does not provide CVSS scoring or confirmed active exploitation. Exposure is likely limited to organizations running ZOHO WebNMS Framework 5.2 or 5.2 SP1 with the file upload functionality reachable. Internet-facing, partner-facing, or broadly authenticated deployments carry higher risk. The bundle does not identify other affected products or versions. Prioritize this as urgent for any reachable WebNMS 5.2 or 5.2 SP1 system. The issue can move from file upload to code execution, but evidence in the bundle is incomplete on patch status and real-world exploitation. Mitigation focus: Identify and remove or isolate WebNMS Framework 5.2 and 5.2 SP1 instances.; Review Zoho/WebNMS vendor guidance before choosing an upgrade or hardening path.; Restrict network access to WebNMS administrative and upload endpoints..

Prepared

Jun 13, 2026, 12:51 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.