CVE-2021-44077: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Published Nov 29, 2021
·
Updated

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution

Affected Software

76 affected components
Zohocorp ManageEngine ServiceDesk Plus=11.1-11138
Zohocorp ManageEngine ServiceDesk Plus=11.1-11139
Zohocorp ManageEngine ServiceDesk Plus=11.1-11140
Zohocorp ManageEngine ServiceDesk Plus=11.1-11141
Zohocorp ManageEngine ServiceDesk Plus=11.1-11142
Zohocorp ManageEngine ServiceDesk Plus=11.1-11143
Zohocorp ManageEngine ServiceDesk Plus=11.1-11144
Zohocorp ManageEngine ServiceDesk Plus=11.1-11145
Zohocorp ManageEngine ServiceDesk Plus=11.2-11200
Zohocorp ManageEngine ServiceDesk Plus=11.2-11201
Zohocorp ManageEngine ServiceDesk Plus=11.2-11202
Zohocorp ManageEngine ServiceDesk Plus=11.2-11203
Zohocorp ManageEngine ServiceDesk Plus=11.2-11204
Zohocorp ManageEngine ServiceDesk Plus=11.2-11205
Zohocorp ManageEngine ServiceDesk Plus=11.2-11206
Zohocorp ManageEngine ServiceDesk Plus=11.2-11207
Zohocorp ManageEngine ServiceDesk Plus=11.2-11208
Zohocorp ManageEngine ServiceDesk Plus=11.2-11209
Zohocorp ManageEngine ServiceDesk Plus=11.2-11210
Zohocorp ManageEngine ServiceDesk Plus=11.2-11211
Zohocorp ManageEngine ServiceDesk Plus=11.3-11300
Zohocorp ManageEngine ServiceDesk Plus=11.3-11301
Zohocorp ManageEngine ServiceDesk Plus=11.3-11302
Zohocorp ManageEngine ServiceDesk Plus=11.3-11303
Zohocorp ManageEngine ServiceDesk Plus=11.3-11304
Zohocorp ManageEngine ServiceDesk Plus=11.3-11305
Zohocorp ManageEngine ServiceDesk Plus MSP<=10.5
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10500
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10501
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10502
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10503
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10504
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10505
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10506
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10507
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10508
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10509
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10510
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10511
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10512
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10513
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10514
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10515
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10516
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10517
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10518
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10519
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10520
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10521
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10522
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10523
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10524
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10525
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10526
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10527
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10528
Zohocorp ManageEngine ServiceDesk Plus MSP=10.5-10529
Zohocorp Manageengine Supportcenter Plus<=11.0
Zohocorp Manageengine Supportcenter Plus=11.0-11000
Zohocorp Manageengine Supportcenter Plus=11.0-11001
Zohocorp Manageengine Supportcenter Plus=11.0-11002
Zohocorp Manageengine Supportcenter Plus=11.0-11003
Zohocorp Manageengine Supportcenter Plus=11.0-11004
Zohocorp Manageengine Supportcenter Plus=11.0-11005
Zohocorp Manageengine Supportcenter Plus=11.0-11006
Zohocorp Manageengine Supportcenter Plus=11.0-11007
Zohocorp Manageengine Supportcenter Plus=11.0-11008
Zohocorp Manageengine Supportcenter Plus=11.0-11009
Zohocorp Manageengine Supportcenter Plus=11.0-11010
Zohocorp Manageengine Supportcenter Plus=11.0-11011
Zohocorp Manageengine Supportcenter Plus=11.0-11012
Zohocorp Manageengine Supportcenter Plus=11.0-11013
Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
Zohocorp ManageEngine ServiceDesk Plus<11.1
Zohocorp ManageEngine ServiceDesk Plus MSP<10.5
Zohocorp Manageengine Supportcenter Plus<11.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade Zoho ManageEngine ServiceDesk Plus to a version that resolves this vulnerability.

    Fixed in 11306
  2. Upgrade

    Upgrade Zoho ManageEngine ServiceDesk Plus MSP to a version that resolves this vulnerability.

    Fixed in 10530
  3. Upgrade

    Upgrade Zoho SupportCenter Plus to a version that resolves this vulnerability.

    Fixed in 11014

Event History

Nov 29, 2021
CVE Published
via MITRE·03:17 AM
Data Sourced
via MITRE·03:17 AM
Description
Data Sourced
04:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Dec 1, 2021
Known Exploited
via CISA·12:00 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2021-44077?

CVE-2021-44077 is classified as a critical vulnerability due to its potential for unauthenticated remote code execution.

2

How do I fix CVE-2021-44077?

To mitigate CVE-2021-44077, update Zoho ManageEngine ServiceDesk Plus or SupportCenter Plus to the latest versions that have patched this vulnerability.

3

Which versions are affected by CVE-2021-44077?

CVE-2021-44077 affects multiple versions of Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus prior to their respective fixed versions.

4

What can attackers achieve with CVE-2021-44077?

Exploiting CVE-2021-44077 allows attackers to execute arbitrary code remotely without any authentication.

5

Is there a workaround for CVE-2021-44077 if I can’t update immediately?

Currently, the recommended mitigation for CVE-2021-44077 is to apply the vendor's patches as no reliable workaround has been provided.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203