CVE-2021-44515 kev in the critical feed json
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in t…
published 2021-12-12 4 y ago modified 2026-06-17 4 mo ago also EUVD-2021-31348
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Exploited
- added 2021-12-10
- epss
- 99.9%
- EPSS 99.9% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.
Patch / fix
cisa required action Apply updates per vendor instructions.
- zohocorp manageengine_desktop_central 10.1.2127.18, 10.1.2137.3
Timeline
- Added to CISA KEV
- Published
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4 y ago
- Patch by
- 2021-12-24 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Zoho, Desktop Central
- CISA name
- Zoho Desktop Central Authentication Bypass Vulnerability
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1190 Exploit Public-Facing Application exploitation
- T1105 Ingress Tool Transfer primary impact
- T1003 OS Credential Dumping secondary impact
- T1069 Permission Groups Discovery secondary impact
- T1087 Account Discovery secondary impact
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- total
- Assessed
- 21 mo ago
Exploit prediction
99.87% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Zoho ManageEngine Desktop Central - Remote Code Execution nuclei detection template
- manageengine.com https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 10.0 | AV:N/AC:L/Au:N/C:C/I:C/A:C |
References
-
manageengine.com
/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html
exploit, patch, vendor-advisory
-
pitstop.manageengine.com
/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-
issue-tracking, vendor-advisory
-
cisa.gov
/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog
broken-link, third-party-advisory, us-government-resource
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44515
government-resource, us-government-resource
Sources
- CVE List CVE-2021-44515
- NVD CVE-2021-44515
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.