What’s Vulnerable › Vulnerabilities

CVE-2021-44077: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2021-12-01
• EPSS: 93.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-11-29 · updated 2026-06-17
• Weakness: CWE-306

Description

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

Affected products

• ManageEngine ServiceDesk Plus: before 11.1; 11.1-11138, 11.1-11139, 11.1-11140, 11.1-11141, 11.1-11142, 11.1-11143 (+20) — fixed in 11.1
• Zohocorp Manageengine Servicedesk Plus Msp: before 10.5; 10.5-10500, 10.5-10501, 10.5-10502, 10.5-10503, 10.5-10504, 10.5-10505 (+24) — fixed in 10.5
• Zohocorp Manageengine Supportcenter Plus: before 11.0; 11.0-11000, 11.0-11001, 11.0-11002, 11.0-11003, 11.0-11004, 11.0-11005 (+8) — fixed in 11.0

How to fix

Upgrade to a fixed version: ManageEngine ServiceDesk Plus 11.1; Zohocorp Manageengine Servicedesk Plus Msp 10.5; Zohocorp Manageengine Supportcenter Plus 11.0. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013
• http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44077

Get alerted when CVE-2021-44077 or the next vulnerability affects your stack