CVE-2016-6600

Public exploit available. Not confirmed exploited in the wild yet. No fix published yet.

CVSS 3.09.8Critical EPSS percentile99th91% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 3 sources FixNone yetNo fix or workaround published

Published 2017-01-23Updated 2026-05-13Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check whether you are running ZOHO WebNMS Framework 5.2 or 5.2 SP1.
Check whether the file upload feature (FileUploadServlet) is reachable from the internet, or accessible from external networks.
If reachable externally, restrict network access so external users cannot reach the WebNMS Framework upload endpoint.
Contact your Zoho/WebNMS support channel and ask for an official fixed version for CVE-2016-6600 (no patch details are available here).
If you can’t get a fixed version quickly, prioritize compensating controls: keep upload functionality disabled (if possible) and ensure it is only reachable from trusted internal networks.

May need vendor or contractor work

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter to servlets/FileUploadServlet.

In plain language

Written by AI from the record

ZOHO WebNMS Framework 5.2 and 5.2 SP1 have a file upload flaw that can let an internet attacker upload and run malicious code; if your system exposes this upload feature to the internet, you should treat it as urgent.

Directory traversal in ZOHO WebNMS Framework 5.2/5.2 SP1 file upload (CWE-22) allows remote attackers to upload and execute arbitrary JSP files via a crafted fileName containing “..” sequences targeting servlets/FileUploadServlet.

If you're affected

Full server compromise
Malware and persistence
Operational disruption
Customer data exposure

What is it

Imagine an app that lets users upload a file, but it also trusts the file name too much. By using special “../” style tricks, an attacker can trick the system into placing a file somewhere it shouldn’t, then run it as code. That’s like giving someone the keys to copy a weapon into your building and then being able to activate it.

Who is affected

This matters if you use ZOHO WebNMS Framework version 5.2 or 5.2 SP1 and you have the file upload functionality enabled. It’s most concerning when an attacker can reach the upload endpoint from outside your network (internet-reachable exposure).

How urgent is it

This should be treated as RED because there is public weaponization with working proof-of-concept code available, making real-world attacks more likely. Even though CISA KEV does not list this item, the presence of public PoC and a very high predicted likelihood mean you should act now—especially if the upload feature is externally reachable.

What to do — in detail

Confirm exposure in your environment
- Identify whether your ZOHO WebNMS Framework is exactly 5.2 or 5.2 SP1.
- Determine if servlets/FileUploadServlet (or the file upload page/API that uses it) is reachable from the internet.
Determine whether external access is possible
- Review firewall rules, reverse proxy settings, and any port forwarding.
- Confirm whether external users can access the upload functionality without going through a tightly controlled internal network path.
Immediate mitigation if external reachability exists
- Block external access to the upload endpoint (or the entire WebNMS Framework web interface if that’s the safest path).
- If you need the service for internal teams, allow only specific trusted IP ranges/VPN users.
- If your configuration allows it, disable the upload capability temporarily while you work on a fix.
Get the official fix
- No patch/fixed version information is available in the provided findings for CVE-2016-6600.
- Contact Zoho/WebNMS support and ask for the fixed version for your exact branch (5.2 vs 5.2 SP1) and any required upgrade steps.
If you cannot patch immediately
- Keep upload functionality disabled or non-public.
- Add/verify WAF or reverse-proxy rules that block requests attempting directory traversal patterns in fileName parameters (for example, “..”).
- Monitor logs for repeated upload attempts, unusual file names, and errors around upload paths.
What to monitor after changes
- Access logs for the upload endpoint (spikes, repeated failures).
- File creation/upload logs, especially where files are written outside expected directories.
- Any subsequent requests for JSP or other executable files placed via upload attempts.

Technical context

Severity is effectively CRITICAL given the capability described: attackers can upload and execute arbitrary JSP files. The weakness is CWE-22 (directory traversal), triggered through the file upload mechanism by crafting the fileName parameter to include “..” sequences to escape the intended upload directory. Public weaponization exists (public PoC on GitHub; 3 known). No KEV listing was found, and no patch details are available in the provided findings, so remediation must rely on vendor guidance plus compensating controls. KEV not listed means CISA has not formally cataloged it in the provided dataset; exploitation status in the findings is supported by the availability of public PoC/weaponization rather than an official KEV entry.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS99th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

3 sources with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

91% chance of exploitation activity in the next 30 days, which ranks it in the 99th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

23 events over 3530 days, from the signal feeds we watch.

2026-09-23EPSS band changehigh → criticalepss band change
2026-09-21EPSS band changecritical → highepss band change
2026-09-06EPSS band changehigh → criticalepss band change
2026-09-05EPSS band changecritical → highepss band change
2026-08-31EPSS band changehigh → criticalepss band change
2026-08-29EPSS band changecritical → high

Affected products

zohocorpcommercial · INaka zoho corp, manageengine
- webnms frameworkOn-premNetworking Infrastructure / network-management

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.0 vector

Open in the CVSS calculator

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable