{"id":"CVE-2021-44515","kind":"vulnerability","aliases":["CVE-2021-44515"],"related":[],"title":"Zoho Desktop Central: Zoho Desktop Central Authentication Bypass Vulnerability","description":"Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.","summary":"Zoho Desktop Central, an IT management server for managed service providers, has an authentication bypass that lets an unauthenticated attacker reach the MSP server. The sources say the bypass can lead to arbitrary code execution on that server.","severity":"critical","cvss":10.0,"epss":0.99871,"exploited":true,"exploited_at":"2021-12-10T00:00:00+00:00","products":[{"name":"Zoho Desktop Central","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","msp","other","self-hosted","zoho-desktop-central"],"not_affected_if":["not-zoho-desktop-central"],"how_to_check":null,"fix":"Apply the updates from Zoho per vendor instructions, as CISA requires; the fixed version is unknown from these sources.","status":"open","published_at":"2021-12-10T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:31:54+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T21:31:54Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates from Zoho per vendor instructions, as CISA requires; the fixed version is unknown from these sources.","reach":"network","impact":"high","summary":"Zoho Desktop Central, an IT management server for managed service providers, has an authentication bypass that lets an unauthenticated attacker reach the MSP server. The sources say the bypass can lead to arbitrary code execution on that server.","category":"other","who_cares":["zoho-desktop-central","msp","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Desktop Central MSP server","analyst_note":"Find the affected and fixed Desktop Central MSP build numbers and the vendor advisory from Zoho, plus a detection method, via the CISA KEV entry or Zoho's security bulletin.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-zoho-desktop-central"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000471,"input_tokens":2838,"output_tokens":374,"severity_before":"unknown"},"analyst_status":"queued","analyst_note":"Find the affected and fixed Desktop Central MSP build numbers and the vendor advisory from Zoho, plus a detection method, via the CISA KEV entry or Zoho's security bulletin.","search":"'-2021':11A,14A '-44515':12A,15A '10.1.2127.17':95C,113C '10.1.2127.18':100C,118C '10.1.2128.0':104C,122C '10.1.2137.2':106C,124C '10.1.2137.3':109C,127C '2021':91C 'arbitrari':61B 'attack':48B 'authent':7A,42B,74C 'build':94C,103C,112C,121C 'bypass':8A,43B,57B,75C 'central':3A,6A,18A,28B,31B,70C 'code':62B,79C 'cve':10A,13A 'decemb':90C 'desktop':2A,5A,17A,27B,30B,69C 'earlier':97C,115C 'enterpris':93C,102C 'execut':63B,80C 'exploit':19B,85C 'host':24B 'lead':59B,76C 'let':45B 'manag':34B,37B 'manageengin':68C 'msp':20B,51B,111C,120C 'provid':39B 'reach':49B 'remot':78C 'say':55B 'self':23B 'self-host':22B 'server':35B,52B,66B,83C 'servic':38B 'sourc':54B 'unauthent':47B 'upgrad':98C,107C,116C,125C 'vulner':9A,72C 'wild':88C 'zoho':1A,4A,16A,26B,29B,67C 'zoho-desktop-centr':25B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-12-10T00:00:00+00:00","kev":{"dateAdded":"2021-12-10","dueDate":"2021-12-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-44515","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44515","severity":null,"published_at":"2021-12-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T15:39:43+00:00","note":null},{"source":"epss","external_id":"CVE-2021-44515","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-44515","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-44515","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44515","severity":null,"published_at":"2021-12-12T05:15:07+00:00","modified_at":"2026-06-17T04:12:29+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}