{"id":"CVE-2021-37415","kind":"vulnerability","aliases":["CVE-2021-37415"],"related":[],"title":"Zoho ManageEngine ServiceDesk Plus (SDP): Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability","description":"Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication\n\nCISA required action: Apply updates per vendor instructions.","summary":"Zoho ManageEngine ServiceDesk Plus before build 11302 has an authentication bypass that lets a few REST API URLs be reached without logging in. Attackers are exploiting it in the wild, per CISA's Known Exploited Vulnerabilities catalog.","severity":"critical","cvss":9.8,"epss":0.99825,"exploited":true,"exploited_at":"2021-12-01T00:00:00+00:00","products":[{"name":"Zoho ManageEngine ServiceDesk Plus (SDP)","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","manageengine","self-hosted","servicedesk-plus","vendor"],"not_affected_if":["already-patched-build","managed-hosting"],"how_to_check":"Check the installed ServiceDesk Plus build number against 11302; anything lower is affected.","fix":"Upgrade ServiceDesk Plus to build 11302 or later, following Zoho's vendor instructions as CISA requires.","status":"open","published_at":"2021-09-01T06:15:06+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:58+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T21:31:58Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade ServiceDesk Plus to build 11302 or later, following Zoho's vendor instructions as CISA requires.\nunknown","reach":"internet","impact":"high","summary":"Zoho ManageEngine ServiceDesk Plus before build 11302 has an authentication bypass that lets a few REST API URLs be reached without logging in. Attackers are exploiting it in the wild, per CISA's Known Exploited Vulnerabilities catalog.","category":"vendor","who_cares":["self-hosted","manageengine","servicedesk-plus"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker reaches REST API endpoints and can read or change helpdesk data.","analyst_note":"Confirm the exact list of unauthenticated REST URLs and whether data access or code execution follows, via the NVD/Zoho advisory for CVE-2021-37415.","how_to_check":"Check the installed ServiceDesk Plus build number against 11302; anything lower is affected.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","already-patched-build"],"user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000505,"input_tokens":2874,"output_tokens":436,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':13A,16A '-37415':14A,17A '11302':38B,74C 'action':92C 'allow':81C 'api':48B,86C 'appli':93C 'attack':55B 'authent':9A,41B,78C,89C 'build':37B 'bypass':10A,42B,79C 'catalog':68B 'cisa':63B,90C 'cve':12A,15A 'exploit':23B,57B,66B 'host':27B 'instruct':97C 'known':65B 'let':44B 'log':53B 'manageengin':2A,7A,24B,33B,70C 'manageengine':19A 'per':62B,95C 'plus':4A,21A,30B,35B,72C 'reach':51B 'requir':91C 'rest':47B,85C 'rest-api':84C 'sdp':5A,22A 'self':26B 'self-host':25B 'servicedesk':3A,8A,20A,29B,34B,71C 'servicedesk-plus':28B 'updat':94C 'url':49B,87C 'vendor':31B,96C 'vulner':11A,67B,76C 'wild':61B 'without':52B,88C 'zoho':1A,6A,18A,32B,69C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-09-01T06:15:06+00:00","kev":{"dateAdded":"2021-12-01","dueDate":"2021-12-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-37415","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-37415","severity":null,"published_at":"2021-12-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T14:39:41+00:00","note":null},{"source":"epss","external_id":"CVE-2021-37415","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-37415","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-37415","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-37415","severity":null,"published_at":"2021-09-01T06:15:06+00:00","modified_at":"2026-06-17T04:00:29+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}