CVE-2019-8394
Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability
Published Feb 16, 2019 · updated Jun 16, 2026 · zohocorp manageengine servicedesk plus
Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
Timeline
Detection, updates, and resolution for this record.
Feb 16, 2019 · Catalog
Detected
Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe zohocorp/manageengine servicedesk plusversion unspecified
- cpe zohocorp/manageengine servicedesk plus10.0.0
- vendor Zoho ManageEngineversion unspecified
Sources
- CISA KEVCVE-2019-8394
Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.
cisa.gov - CVE.orgCVE-2019-8394
Official CVE identifier
cve.org - FIRST EPSSCVE-2019-8394
30-day exploitation probability 63.3%
first.org - Exploit Database46413
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit Modulesexploit_multi/http/manageengine_sd_uploader
Public module reference (excellent). Module source is not copied into this catalog.
rapid7.com - NIST NVDCVE-2019-8394
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
nvd.nist.gov