---
id: "CVE-2021-44077"
kind: "vulnerability"
aliases: ["CVE-2021-44077"]
title: "Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.93298
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "infrastructure", "self-hosted", "servicedesk-plus", "supportcenter-plus", "windows"]
not_affected_if: ["fixed-build", "managed-hosting"]
published_at: "2021-11-29T04:15:06+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44077", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-44077", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44077", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus: Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability

Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP and SupportCenter Plus before the fixed builds allow unauthenticated remote code execution. An attacker who can reach the web service can run commands on the server without logging in.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus affected ? fixed ?

## How to check

Check the installed build number against the fixed versions: ServiceDesk Plus below 11306, ServiceDesk Plus MSP below 10530, SupportCenter Plus below 11014.

## Fix

Upgrade ServiceDesk Plus to build 11306 or later, ServiceDesk Plus MSP to 10530 or later, or SupportCenter Plus to 11014 or later, per Zoho's vendor instructions.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44077
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-44077
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-44077

## From the sources

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_