Snapshot of public data from 31 Oct 2026, 12:50:06. This data is not updated until the API is deployed.

CVE-2021-44077

Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

UrgentCVSS 9.8 v3.1Exploited

Why this priority

Generic watch priority computed by public, versioned rules. It does not know your assets. See the glossary

Présent dans le catalogue CISA KEV (exploitation confirmée)

Description

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

Affected products

Vendor	Product	Versions
Zoho	ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus	All versions
n/a	n/a	n/a

Revision history

Revision 3 31 Oct 2026, 12:49:34
Revision 2 31 Oct 2026, 12:27:42
Update : Affected versions changed
Revision 1 31 Oct 2026, 12:27:08
New record

Qualification

CVSS severity ? Technical severity score between 0 and 10, with its version (3.1, 4.0). See the glossary: 9.8 CRITICAL CVSS v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KEV catalog ? CISA catalog of vulnerabilities with confirmed exploitation. Absence from the catalog does not prove absence of exploitation. See the glossary: Listed
Exploitation: Confirmed
EPSS probability ? Probability, between 0 and 1, that a vulnerability is exploited in the next 30 days, published daily by FIRST. Always dated. See the glossary: Unknown
Confidence ? Quality of the sources behind the record. It is not a risk score. See the glossary: High

Priority rules, version 1

CISA KEV catalog

Added on: 1 December 2021
Federal due date: 15 December 2021
Required action: Apply updates per vendor instructions.
Ransomware use: Unknown

Record

Published on: 29 November 2021
Weaknesses (CWE): CWE-306

Sources

Source : CISA Known Exploited Vulnerabilities Catalog Terms of use
Source : CVE Program, cve.org Terms of use