What’s Vulnerable › Vulnerabilities

CVE-2021-44675

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-12-20 · updated 2026-06-17
• Weakness: CWE-287

Description

Zoho ManageEngine ServiceDesk Plus MSP before 10.5 Build 10534 is vulnerable to unauthenticated remote code execution due to a filter bypass in which authentication is not required.

Affected products

• Zohocorp Manageengine Servicedesk Plus Msp: through 10.5; 10.5-10500, 10.5-10501, 10.5-10502, 10.5-10503, 10.5-10504, 10.5-10505 (+28)

References

• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerabilities-in-servicedesk-plus-msp-that-could-lead-to-remote-code-execution
• https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerabilities-in-servicedesk-plus-msp-that-could-lead-to-remote-code-execution

Get alerted when CVE-2021-44675 or the next vulnerability affects your stack