VULNERABILITY INTELLIGENCE

CVE-2021-44515

CVSS score9.8 CRITICAL

EPSS probability99.87%

CISA KEVKnown exploited vulnerability

Published2021-12-12

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Zoho Desktop Central Authentication Bypass Vulnerability

Vendor / product: Zoho / Desktop Central

Description

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.

Weakness classification

nvd@nist.gov: NVD-CWE-noinfo

Primary references

cve@mitre.org — Issue Tracking, Vendor Advisory
cve@mitre.org — Broken Link, Third Party Advisory, US Government Resource
cve@mitre.org — Exploit, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Broken Link, Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource