diff --git a/CHANGELOG.md b/CHANGELOG.md
index a22f2086230c0..3419220361939 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,7 @@ Inspired from [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 - Bump `Netty` from 4.1.114.Final to 4.1.115.Final ([#16661](https://github.com/opensearch-project/OpenSearch/pull/16661))
 - Bump `avro` from 1.11.3 to 1.11.4 ([#16773](https://github.com/opensearch-project/OpenSearch/pull/16773))
 - Bump `protobuf-java` to 3.22.5 ([#16779](https://github.com/opensearch-project/OpenSearch/pull/16779))
+- Bump `commonsio` to 2.16.0 ([#16780](https://github.com/opensearch-project/OpenSearch/pull/16780))
 
 ### Changed
 ### Deprecated
diff --git a/buildSrc/build.gradle b/buildSrc/build.gradle
index 3da274ef4244f..39ee079b5b6e6 100644
--- a/buildSrc/build.gradle
+++ b/buildSrc/build.gradle
@@ -126,7 +126,7 @@ dependencies {
   }
   api 'org.eclipse.jgit:org.eclipse.jgit:6.8.0.202311291450-r'
   api 'org.apache.rat:apache-rat:0.13'
-  api 'commons-io:commons-io:2.7'
+  api 'commons-io:commons-io:2.16.0'
   api "net.java.dev.jna:jna:5.5.0"
   api 'com.github.jengelman.gradle.plugins:shadow:6.0.0'
   api 'de.thetaphi:forbiddenapis:3.2'
diff --git a/plugins/discovery-azure-classic/build.gradle b/plugins/discovery-azure-classic/build.gradle
index f02d964893709..68bda0933daa7 100644
--- a/plugins/discovery-azure-classic/build.gradle
+++ b/plugins/discovery-azure-classic/build.gradle
@@ -53,7 +53,7 @@ dependencies {
   api "org.apache.logging.log4j:log4j-1.2-api:${versions.log4j}"
   api "commons-codec:commons-codec:${versions.commonscodec}"
   api "commons-lang:commons-lang:2.6"
-  api "commons-io:commons-io:2.7"
+  api "commons-io:commons-io:2.16.0"
   api 'javax.mail:mail:1.4.7'
   api 'javax.inject:javax.inject:1'
   api "com.sun.jersey:jersey-client:${versions.jersey}"
diff --git a/plugins/discovery-azure-classic/licenses/commons-io-2.16.0.jar.sha1 b/plugins/discovery-azure-classic/licenses/commons-io-2.16.0.jar.sha1
new file mode 100644
index 0000000000000..6a7b638719fa3
--- /dev/null
+++ b/plugins/discovery-azure-classic/licenses/commons-io-2.16.0.jar.sha1
@@ -0,0 +1 @@
+27875a7935f1ddcc13267eb6fae1f719e0409572
\ No newline at end of file
diff --git a/plugins/discovery-azure-classic/licenses/commons-io-2.7.jar.sha1 b/plugins/discovery-azure-classic/licenses/commons-io-2.7.jar.sha1
deleted file mode 100644
index bbb1b15dd1e1e..0000000000000
--- a/plugins/discovery-azure-classic/licenses/commons-io-2.7.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-3f2bd4ba11c4162733c13cc90ca7c7ea09967102
\ No newline at end of file
diff --git a/plugins/ingest-attachment/build.gradle b/plugins/ingest-attachment/build.gradle
index cf26d8a1c3641..b633ecb56769e 100644
--- a/plugins/ingest-attachment/build.gradle
+++ b/plugins/ingest-attachment/build.gradle
@@ -57,7 +57,7 @@ dependencies {
   runtimeOnly "com.google.guava:guava:${versions.guava}"
   // Other dependencies
   api 'org.tukaani:xz:1.9'
-  api 'commons-io:commons-io:2.11.0'
+  api 'commons-io:commons-io:2.16.0'
   api "org.slf4j:slf4j-api:${versions.slf4j}"
 
   // character set detection
diff --git a/plugins/ingest-attachment/licenses/commons-io-2.11.0.jar.sha1 b/plugins/ingest-attachment/licenses/commons-io-2.11.0.jar.sha1
deleted file mode 100644
index 8adec30bade49..0000000000000
--- a/plugins/ingest-attachment/licenses/commons-io-2.11.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-a2503f302b11ebde7ebc3df41daebe0e4eea3689
\ No newline at end of file
diff --git a/plugins/ingest-attachment/licenses/commons-io-2.16.0.jar.sha1 b/plugins/ingest-attachment/licenses/commons-io-2.16.0.jar.sha1
new file mode 100644
index 0000000000000..6a7b638719fa3
--- /dev/null
+++ b/plugins/ingest-attachment/licenses/commons-io-2.16.0.jar.sha1
@@ -0,0 +1 @@
+27875a7935f1ddcc13267eb6fae1f719e0409572
\ No newline at end of file
diff --git a/plugins/repository-hdfs/build.gradle b/plugins/repository-hdfs/build.gradle
index f514bb5a9d275..f924245b5404b 100644
--- a/plugins/repository-hdfs/build.gradle
+++ b/plugins/repository-hdfs/build.gradle
@@ -74,7 +74,7 @@ dependencies {
   api 'commons-collections:commons-collections:3.2.2'
   api 'org.apache.commons:commons-compress:1.21'
   api 'org.apache.commons:commons-configuration2:2.8.0'
-  api 'commons-io:commons-io:2.11.0'
+  api 'commons-io:commons-io:2.16.0'
   api 'org.apache.commons:commons-lang3:3.7'
   implementation 'com.google.re2j:re2j:1.1'
   api 'javax.servlet:servlet-api:2.5'
diff --git a/plugins/repository-hdfs/licenses/commons-io-2.11.0.jar.sha1 b/plugins/repository-hdfs/licenses/commons-io-2.11.0.jar.sha1
deleted file mode 100644
index 8adec30bade49..0000000000000
--- a/plugins/repository-hdfs/licenses/commons-io-2.11.0.jar.sha1
+++ /dev/null
@@ -1 +0,0 @@
-a2503f302b11ebde7ebc3df41daebe0e4eea3689
\ No newline at end of file
diff --git a/plugins/repository-hdfs/licenses/commons-io-2.16.0.jar.sha1 b/plugins/repository-hdfs/licenses/commons-io-2.16.0.jar.sha1
new file mode 100644
index 0000000000000..6a7b638719fa3
--- /dev/null
+++ b/plugins/repository-hdfs/licenses/commons-io-2.16.0.jar.sha1
@@ -0,0 +1 @@
+27875a7935f1ddcc13267eb6fae1f719e0409572
\ No newline at end of file