What’s Vulnerable › Vulnerabilities

CVE-2021-37415: Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-12-01
• EPSS: 99.8% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-09-01 · updated 2026-06-17
• Weakness: CWE-306

Description

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

Affected products

• ManageEngine ServiceDesk Plus: 11.0-11005, 11.0-11006, 11.0-11007, 11.0-11008, 11.0-11009, 11.0-11010 (+59)

References

• https://www.manageengine.com
• https://www.manageengine.com/products/service-desk/on-premises/readme.html#11302
• https://www.manageengine.com
• https://www.manageengine.com/products/service-desk/on-premises/readme.html#11302
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-37415

Get alerted when CVE-2021-37415 or the next vulnerability affects your stack