CVE-2021-44077
KEVCRITICAL 9.8EPSS 93.3%
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v2.0
- 7.5 HIGH
AV:N/AC:L/Au:N/C:P/I:P/A:P - EPSS
- 93.30% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-12-01
- Nuclei
- critical · CWE-306
- Published
- 2021-11-29
- Updated
- 2025-10-21
Proof-of-concept exploits (3)
- http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Exe…
- horizon3ai/CVE-2021-4407736★ · 2021-12-08
- pizza-power/Golang-CVE-2021-44077-POC2★ · 2022-10-02