CVE-2021-44077
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Description
CVE-2021-44077 is a critical unauthenticated remote code execution (RCE) vulnerability affecting Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus. The vulnerability allows remote attackers to execute arbitrary code without authentication, stemming from missing authentication on servlet and REST-API endpoints. This remote code execution flaw in ManageEngine ServiceDesk Plus is related to /RestAPI URLs and the ImportTechnicians function in the Struts configuration. CISA has confirmed active exploitation of CVE-2021-44077, and an EPSS score of 94.25% (99.9th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| zohocorp | manageengine servicedesk plus | < 11.1; 11.1; 11.2; 11.3 |
| zohocorp | manageengine servicedesk plus msp | < 10.5; 10.5 |
| zohocorp | manageengine supportcenter plus | < 11.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above(Patch, Vendor Advisory)
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529(Vendor Advisory)
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021(Vendor Advisory)
- https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44077(US Government Resource)
Weakness Type
CWE-306: Missing Authentication for Critical Function
In CVE-2021-44077, Zoho ManageEngine ServiceDesk Plus exposes critical servlet endpoints, including /RestAPI paths and the ImportTechnicians function, without requiring authentication. This missing authentication for critical functions enables unauthenticated remote attackers to invoke privileged operations that lead directly to arbitrary code execution on the server.
Learn more: CWE-306 — Missing Authentication for Critical Function
Impact Analysis
CVE-2021-44077 carries a CVSS 3.1 score of 9.8 (CRITICAL), the highest severity tier, reflecting maximum exploitability and impact. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction — making exploitation trivial for any attacker with network access. Successful exploitation enables full remote code execution, giving attackers complete control over the affected server with the privileges of the application process. All three impact metrics are rated HIGH, meaning attackers can access all managed data (confidentiality), modify configurations and service tickets (integrity), and disrupt IT service operations (availability). With an EPSS score of 94.25%, this vulnerability is near-certain to be targeted, and organizations running affected ManageEngine products face immediate risk of complete system compromise.
Exploit Maturity
CVE-2021-44077 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, with a remediation deadline of 2021-12-15. Public exploit code is available for CVE-2021-44077 via Packet Storm Security, significantly lowering the barrier to exploitation. The EPSS score of 94.25% (99.9th percentile) indicates near-certain exploitation activity, placing this among the most actively targeted vulnerabilities. The combination of unauthenticated RCE, public exploit availability, and confirmed active exploitation makes this an emergency requiring immediate action.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: update ManageEngine ServiceDesk Plus to version 11306 or later, ServiceDesk Plus MSP to version 10530 or later, and SupportCenter Plus to version 11014 or later.
- Verify all instances of affected products have been updated: ManageEngine ServiceDesk Plus (versions < 11.1, 11.1, 11.2, 11.3 prior to build 11306), ServiceDesk Plus MSP (versions < 10.5 and 10.5 prior to build 10530), and SupportCenter Plus (versions < 11.0 and 11.0 prior to build 11014).
- Restrict network access to ManageEngine applications using firewall rules, particularly blocking external access to /RestAPI endpoints and the ImportTechnicians servlet path. Place the application behind a reverse proxy with enforced authentication.
- Conduct a thorough forensic review of affected systems, examining web server logs for unauthenticated access to /RestAPI URLs and ImportTechnicians endpoints, and check for indicators of compromise such as unauthorized accounts, web shells, or unexpected processes.
- Implement network segmentation to isolate ManageEngine ServiceDesk Plus servers from critical infrastructure, and deploy endpoint detection and response (EDR) solutions to monitor for post-exploitation activity.
Technical Details
CVE-2021-44077 affects Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014. The vulnerability is rooted in missing authentication (CWE-306) on critical servlet endpoints, specifically /RestAPI URLs and the ImportTechnicians function defined in the Apache Struts configuration. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms trivial remote exploitation: network-accessible with no complexity barriers, no authentication required, and no user interaction needed. By sending crafted requests to these unauthenticated endpoints, attackers achieve arbitrary code execution with the privileges of the ServiceDesk Plus application process, typically resulting in full server compromise.
Frequently Asked Questions
Is CVE-2021-44077 being actively exploited?
Yes. CVE-2021-44077 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Public exploit code is available on Packet Storm Security, and the EPSS score of 94.25% (99.9th percentile) indicates near-certain exploitation.
What products are affected by CVE-2021-44077?
CVE-2021-44077 affects three Zoho ManageEngine products: ServiceDesk Plus (versions before 11306), ServiceDesk Plus MSP (versions before 10530), and SupportCenter Plus (versions before 11014). All three products share the vulnerable servlet endpoints.
How do I fix CVE-2021-44077?
Update to the patched versions: ServiceDesk Plus 11306+, ServiceDesk Plus MSP 10530+, or SupportCenter Plus 11014+. As interim measures, restrict network access to /RestAPI endpoints and the ImportTechnicians function, and place the application behind an authenticating reverse proxy.
How severe is CVE-2021-44077?
CVE-2021-44077 has a CVSS 3.1 score of 9.8 (CRITICAL). It enables unauthenticated remote code execution with no complexity barriers, and has public exploit code available, making it one of the most dangerous vulnerabilities in the ManageEngine product line.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.