Zoho ManageEngine ServiceDesk Plus - Remote Code Execution

🗓️ 16 Jun 2026 07:13:51Reported by ProjectDiscoveryType

Zoho ManageEngine ServiceDesk Plus - Remote Code Execution CVE-2021-4407

Reporter	Title	Published	Views	Family All 36
0day.today	ManageEngine ServiceDesk Plus Remote Code Execution Exploit	28 Dec 202100:00	–	zdt
GithubExploit	Exploit for Missing Authentication for Critical Function in Zohocorp Manageengine_Servicedesk_Plus	8 Dec 202120:24	–	githubexploit
GithubExploit	Exploit for Missing Authentication for Critical Function in Zohocorp Manageengine_Servicedesk_Plus	29 Sep 202214:07	–	githubexploit
ICS	APT Actors Exploiting CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus	6 Dec 202112:00	–	ics
ATTACKERKB	CVE-2021-44077	29 Nov 202100:00	–	attackerkb
BDU FSTEC	The vulnerability of the configuration of software solutions for Zoho ManageEngine ServiceDesk Plus, Zoho ManageEngine ServiceDesk Plus MSP, and Zoho ManageEngine SupportCenter Plus lies in the absence of authentication procedures, which allow attackers to execute arbitrary code.	7 Feb 202200:00	–	bdu_fstec
Circl	CVE-2021-44077	3 Dec 202111:08	–	circl
CISA KEV Catalog	Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability	1 Dec 202100:00	–	cisa_kev
CISA	CISA Adds Five Known Exploited Vulnerabilities to Catalog	1 Dec 202100:00	–	cisa
CISA	CISA and FBI Release Alert on Active Exploitation of CVE-2021-44077 in Zoho ManageEngine ServiceDesk Plus	2 Dec 202100:00	–	cisa

Source	Link
cisa	www.cisa.gov/uscert/ncas/alerts/aa21-336a
unit42	www.unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/
github	www.github.com/horizon3ai/CVE-2021-44077
github	www.github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb
nvd	www.nvd.nist.gov/vuln/detail/CVE-2021-44077

id: CVE-2021-44077

info:
  name: Zoho ManageEngine ServiceDesk Plus - Remote Code Execution
  author: Adam Crosser,gy741
  severity: critical
  description: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
  remediation: |
    Apply the latest security patch or upgrade to a patched version of Zoho ManageEngine ServiceDesk Plus.
  reference:
    - https://www.cisa.gov/uscert/ncas/alerts/aa21-336a
    - https://unit42.paloaltonetworks.com/tiltedtemple-manageengine-servicedesk-plus/
    - https://github.com/horizon3ai/CVE-2021-44077
    - https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/manageengine_servicedesk_plus_cve_2021_44077.rb
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44077
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-44077
    cwe-id: CWE-306
    epss-score: 0.93514
    epss-percentile: 0.99827
    cpe: cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:11.1:11138:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zohocorp
    product: manageengine_servicedesk_plus
    shodan-query: http.title:"manageengine servicedesk plus"
    fofa-query: title="manageengine servicedesk plus"
    google-query: intitle:"manageengine servicedesk plus"
  tags: cve2021,cve,rce,kev,msf,zoho,manageengine,zohocorp,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/RestAPI/ImportTechnicians"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - '<form name="ImportTechnicians"'

      - type: status
        status:
          - 200
# digest: 490a00463044022036fe9b72abeea6c94fdc97c42cef1ead60731a21fcf518a9dbd6b7e28d1b4ee702200acb7877b4d1ba295bf729fc2af0ccea8513cc003901713d5c4438133f9c0eab:922c64590222798bb761d5b6d8e72950

04 Feb 2026 07:00Current

9.2High risk

Vulners AI Score9.2

CVSS 27.5

CVSS 3.19.8

EPSS0.93514

SSVC