---
id: "CVE-2019-8394"
kind: "vulnerability"
aliases: ["CVE-2019-8394"]
title: "Zoho ManageEngine: Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability"
severity: "high"
cvss: 7.5
epss: 0.63336
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Zoho ManageEngine", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "self-hosted", "servicedesk-plus", "vendor", "zoho-manageengine"]
not_affected_if: ["managed-hosting", "not-servicedesk-plus"]
published_at: "2019-02-17T04:29:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T20:29:43+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8394", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2019-8394", "first_seen_at": "2026-10-23T19:13:43+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8394", "first_seen_at": "2026-10-23T19:35:23+00:00"}]
---

# Zoho ManageEngine: Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability

Zoho ManageEngine ServiceDesk Plus (SDP) has an unspecified flaw in login page customization that lets remote users upload files. An attacker who can reach the login page can place files on the server, which typically leads to code execution, though the sources do not state the exact impact.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zoho ManageEngine affected ? fixed ?

## Fix

Apply the vendor update per Zoho ManageEngine instructions (CISA required action); the affected and fixed versions are not stated in the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2019-8394
- 2026-10-23T19:13:43+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2019-8394
- 2026-10-23T19:35:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2019-8394

## From the sources

Zoho ManageEngine ServiceDesk Plus (SDP) contains an unspecified vulnerability that allows remote users to upload files via login page customization.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_