CVE-2021-44077: Zoho ManageEngine ServiceDesk Plus unauthenticated RCE, actively exploited
The short version: CVE-2021-44077 is an unauthenticated remote code execution flaw in Zoho ManageEngine ServiceDesk Plus (and related products). A missing authentication check on a REST API path lets an attacker upload an executable and plant a web shell, then run commands on the server. It scores 9.8, it was exploited by APT actors, and it's in CISA's KEV catalog. Patch-and-verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 93.51% · 99.83th percentile (2026-07-17) |
| In CISA KEV? | Yes — added 2021-12-01, remediation due 2021-12-15 |
| Known exploited? | Yes — exploited by APT actors (subject of CISA/FBI advisory AA21-336A) |
| Vulnerability type | CWE-306 missing authentication → unauthenticated file upload / web shell → remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | ServiceDesk Plus before 11306; ServiceDesk Plus MSP before 10530; SupportCenter Plus before 11014 |
| Fixed in | ServiceDesk Plus 11306 · ServiceDesk Plus MSP 10530 · SupportCenter Plus 11014 (and later) |
What you need to know
ServiceDesk Plus is a widely deployed IT help-desk and asset-management platform. CVE-2021-44077 stems from a missing authentication check on a REST API path (tied to the ImportTechnicians Struts action): an attacker can reach a protected function without credentials, upload an executable file, and use it to drop a web shell — from there, arbitrary commands run on the server.
Why it's a top-priority item:
- It's pre-authentication. No login is needed to reach the vulnerable path.
- It leads to a durable foothold. The documented attack chain drops a web shell (a Godzilla variant was observed), enabling ongoing post-exploitation.
- It was used by APT actors. CISA and the FBI issued a joint advisory; attackers were known to run clean-up scripts, making compromise hard to spot after the fact.
How serious we see it
High — the 9.8 holds up.
Unauthenticated code execution on an internet-facing management platform, with confirmed APT use and a web-shell endgame, is exactly top-of-queue. The bounded, reassuring part is that it's narrow and fixable: specific products and version floors, published fixes, and a fast exposure check. The catch — flagged plainly by CISA — is that attackers cleaned up after themselves, so a clean-looking box that was reachable pre-patch still deserves a real hunt.
Recommendations
Straight from ManageEngine's security response guidance and CISA/FBI (AA21-336A):
- Patch now. Upgrade to ServiceDesk Plus 11306 / ServiceDesk Plus MSP 10530 / SupportCenter Plus 11014 or later.
- Hunt. Run the vendor's exploit-detection tool and review access logs for the affected REST API path and for planted web shells.
- If compromised, respond. Rebuild the host, rotate credentials and secrets, and consider domain-wide password resets where the intrusion reached Active Directory.
- Harden exposure. Restrict who can reach the application from the internet and keep the management surface off the open internet.
- Confirm your exposure first. Verify whether you run an affected build at all.
How BreachRisk sees it
BreachRisk discovers internet-facing ManageEngine ServiceDesk Plus and SupportCenter Plus instances from little more than your domain, fingerprints the version, and flags exposure tied to this KEV-listed, actively exploited flaw — surfaced at the top of your results because it's in KEV. Because the affected endpoint is remotely checkable, BreachRisk can go beyond version-matching and safely confirm whether the vulnerable endpoint is reachable and responding, as a bounded, benign check rather than a weaponized exploit.
That continuous, attacker's-eye view is the whole point: an exposed help-desk platform running an affected build is already mapped and ranked, so you can go straight to patch-and-verify.