{"id":"CVE-2021-44077","kind":"vulnerability","aliases":["CVE-2021-44077"],"related":[],"title":"Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability","description":"Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.","summary":"Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus before the fixed builds allow unauthenticated remote code execution. An attacker who can reach the web service can run commands on the server without logging in.","severity":"critical","cvss":9.8,"epss":0.93298,"exploited":true,"exploited_at":"2021-12-01T00:00:00+00:00","products":[{"name":"Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","self-hosted","servicedesk-plus","supportcenter-plus","windows"],"not_affected_if":["fixed-build","managed-hosting"],"how_to_check":"Check the installed build number against the fixed versions: ServiceDesk Plus below 11306, ServiceDesk Plus MSP below 10530, SupportCenter Plus below 11014.","fix":"Upgrade ServiceDesk Plus to build 11306 or later, ServiceDesk Plus MSP to 10530 or later, or SupportCenter Plus to 11014 or later, per Zoho's vendor instructions.","status":"open","published_at":"2021-11-29T04:15:06+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:32:00+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-10-23T21:32:00Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade ServiceDesk Plus to build 11306 or later, ServiceDesk Plus MSP to 10530 or later, or SupportCenter Plus to 11014 or later, per Zoho's vendor instructions.\nunknown","reach":"internet","impact":"high","summary":"Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus before the fixed builds allow unauthenticated remote code execution. An attacker who can reach the web service can run commands on the server without logging in.","category":"infrastructure","who_cares":["servicedesk-plus","supportcenter-plus","self-hosted","windows"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs arbitrary code on the server.","analyst_note":"Confirm the exact build-number check and vendor advisory link for the fixed versions; sources only give the KEV entry and EPSS score.","how_to_check":"Check the installed build number against the fixed versions: ServiceDesk Plus below 11306, ServiceDesk Plus MSP below 10530, SupportCenter Plus below 11014.\nunknown","needs_analyst":true,"not_affected_if":["managed-hosting","fixed-build"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000533,"input_tokens":2920,"output_tokens":482,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':17A,20A '-44077':18A,21A '/restapi':103C '10530':86C '11014':91C '11306':81C 'allow':55B 'attack':61B 'build':54B 'code':13A,58B,97C 'command':70B 'configur':113C 'cve':16A,19A 'execut':14A,59B,98C 'exploit':29B 'fix':53B 'host':33B 'importtechnician':109C 'infrastructur':30B 'log':75B 'manageengin':2A,9A,42B,77C 'manageengine':23A 'msp':47B,84C 'plus':4A,7A,11A,25A,28A,36B,39B,44B,46B,50B,79C,83C,89C 'reach':64B 'relat':101C 'remot':12A,57B,96C 'run':69B 'sdp':5A,26A 'self':32B 'self-host':31B 'server':73B 'servic':67B 'servicedesk':3A,10A,24A,35B,43B,45B,78C,82C 'servicedesk-plus':34B 'servlet':107C 'strut':112C 'supportcent':6A,38B,49B,88C 'supportcenter':27A 'supportcenter-plus':37B 'unauthent':56B,95C 'url':104C 'vulner':15A,93C 'web':66B 'window':40B 'without':74B 'zoho':1A,8A,22A,41B,76C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-11-29T04:15:06+00:00","kev":{"dateAdded":"2021-12-01","dueDate":"2021-12-15","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-44077","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44077","severity":null,"published_at":"2021-12-01T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2021-44077","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44077","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-44077","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44077","severity":null,"published_at":"2021-11-29T04:15:06+00:00","modified_at":"2026-06-17T04:11:52+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}