---
id: "CVE-2021-44515"
kind: "vulnerability"
aliases: ["CVE-2021-44515"]
title: "Zoho Desktop Central: Zoho Desktop Central Authentication Bypass Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.99871
exploited: true
status: "open"
category: "other"
products: [{"name": "Zoho Desktop Central", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "msp", "other", "self-hosted", "zoho-desktop-central"]
not_affected_if: ["not-zoho-desktop-central"]
published_at: "2021-12-10T00:00:00+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44515", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-44515", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44515", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Zoho Desktop Central: Zoho Desktop Central Authentication Bypass Vulnerability

Zoho Desktop Central, an IT management server for managed service providers, has an authentication bypass that lets an unauthenticated attacker reach the MSP server. The sources say the bypass can lead to arbitrary code execution on that server.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Zoho Desktop Central affected ? fixed ?

## Fix

Apply the updates from Zoho per vendor instructions, as CISA requires; the fixed version is unknown from these sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-44515
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-44515
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-44515

## From the sources

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_