Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customiza…

published 2019-02-17 7 y ago modified 2026-06-17 4 mo ago also EUVD-2019-17784

cvss: 7.5; version 3.1, CNA
cisa kev: Exploited; added 2021-11-03
epss: 63.3%; EPSS 63.3% chance of exploitation in 30 days, percentile 99.2%
public exploits: 2; Metasploit, Exploit-DB

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

zohocorp manageengine_servicedesk_plus 10.0.0

Timeline

2015-08-20 First public exploit (Metasploit exploit/multi/http/manageengine_sd_uploader)
2019-02-17 Published
2021-11-03 Added to CISA KEV
2022-05-03 CISA patch deadline
2025-02-04 CISA SSVC: exploitation active

Known exploited

Added: 5 y ago (2021-11-03)
Patch by: 2022-05-03 (4 y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Zoho, ManageEngine
CISA name: Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: partial
Assessed: 21 mo ago (2025-02-04)

Exploit prediction

63.34% chance of exploitation in the next 30 days, higher than 99.2% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit exploit/multi/http/manageengine_sd_uploader ManageEngine ServiceDesk Plus Arbitrary File Upload metasploit exploit, excellent rank, 2015-08-20
EDB-46413 Zoho ManageEngine ServiceDesk Plus (SDP) < 10.0 build 10012 - Arbitrary File Upload webapps, 2019-02-18

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	3.1	6.5	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD	2.0	4.0	AV:N/AC:L/Au:S/C:N/I:P/A:N

Classification

Weakness

CWE-434 Unrestricted Upload of File with Dangerous Type

References

exploit-db.com /exploits/46413/
exploit, third-party-advisory, vdb-entry
manageengine.com /products/service-desk/readme.html
release-notes, vendor-advisory
securityfocus.com /bid/107129
vdb-entry, third-party-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-8394
government-resource, us-government-resource

Sources

CVE List CVE-2019-8394
NVD CVE-2019-8394

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary