ZeroDay Findings
Sign inSign up

Findings

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Published Nov 28, 2021 · updated Jun 16, 2026 · zohocorp manageengine servicedesk plus

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 28, 2021 · Catalog

    Detected

    Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

  2. Dec 1, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Dec 15, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

Required action

Apply updates per vendor instructions.

CISA due date Dec 15, 2021

Affected

  • cpe zohocorp/manageengine servicedesk plusversion unspecified
  • cpe zohocorp/manageengine servicedesk plus11.1
  • vendor Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plusversion unspecified

Sources

  • CISA KEVCVE-2021-44077

    Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

    cisa.gov
  • CVE.orgCVE-2021-44077

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-44077

    30-day exploitation probability 93.3%

    first.org
  • Metasploit Modulesexploit_windows/http/manageengine_servicedesk_plus_cve_2021_44077

    Public module reference (excellent). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2021-44077

    Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

    nvd.nist.gov

References