What’s Vulnerable › Vulnerabilities
CVE-2021-41833
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 8.0% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2021-11-11 · updated 2026-06-17
- Weakness: CWE-434
Description
Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.
Affected products
- Zohocorp Manageengine Patch Connect Plus: before 9.0.0; 9.0.0, 9.0.0-build90001, 9.0.0-build90063, 9.0.0-build90064, 9.0.0-build90065, 9.0.0-build90066 (+32) — fixed in 9.0.0
How to fix
Upgrade to a fixed version: Zohocorp Manageengine Patch Connect Plus 9.0.0. Check the vendor advisory for mitigations.
References
- https://pitstop.manageengine.com/portal/en/community/topic/unauthenticated-remote-code-execution-vulnerability-solved
- https://www.manageengine.com/sccm-third-party-patch-management/kb/unauthenticated-remote-code-execution.html
- https://pitstop.manageengine.com/portal/en/community/topic/unauthenticated-remote-code-execution-vulnerability-solved
- https://www.manageengine.com/sccm-third-party-patch-management/kb/unauthenticated-remote-code-execution.html
Get alerted when CVE-2021-41833 or the next vulnerability affects your stack