CVE DatabaseCVE-2021-44077

Updated 2026-06-17한국어 권고문 →

CVE-2021-440779.8/CRITICALCISA KEVCWE-306CWE-306

Zoho ManageEngine ServiceDesk Plus Unauthenticated Remote Code Execution Vulnerability (CVE-2021-44077) Analysis and Mitigation Guide

⚡ Jump to Patch

Affected Vendors

zoho

Affected Components

manageengine servicedesk plus, manageengine servicedesk plus msp, manageengine supportcenter plus

Published Date

2021-11-29

CVSS v3.1

9.8

CRITICAL

EPSS (30d)

93.3%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Zoho ManageEngine ServiceDesk Plus (before 11306), ServiceDesk Plus MSP (before 10530), and SupportCenter Plus (before 11014).

Impact

Unauthenticated remote attackers can bypass authentication to upload and execute malicious files, gaining full system-level control over the target server.

Mitigation

Immediately apply the official vendor patches, restrict external access to vulnerable endpoints, and perform a comprehensive log audit for Indicators of Compromise (IoCs).

Affected Products & Version Scope

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

The primary remediation is upgrading to the patched versions recommended by the vendor. Below are the commands to safely stop the ServiceDesk Plus service and back up the directory on a Linux host before applying the patch.

bash

# 1. Stop the ManageEngine Service
cd /opt/ManageEngine/ServiceDesk/bin
sudo ./shutdown.sh

# 2. Create a full backup of the installation directory
tar -czvf /backup/servicedesk_backup_$(date +%F).tar.gz /opt/ManageEngine/ServiceDesk

# 3. Proceed with the official UpdateManager.sh to apply the downloaded .ppm patch

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict external access to the vulnerable endpoints. You can block requests to the vulnerable paths using an Nginx reverse proxy configuration.

nginx

# Nginx configuration block (/etc/nginx/conf.d/manageengine.conf)
server {
    listen 443 ssl;
    server_name servicedesk.local;

    # Block external access to the vulnerable API endpoints
    location ~* /(RestAPI/ImportTechnicians|ImportTechnicians) {
        deny all;
        return 403;
    }

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

3. Log Audit & IoC Verification Commands

Inspect your access logs and web directories to identify potential exploitation attempts or web shells that may have been uploaded.

bash

# 1. Search access logs for ImportTechnicians requests returning a 200 OK status
grep -i 'ImportTechnicians' /opt/ManageEngine/ServiceDesk/logs/access_log* | grep ' 200 '

# 2. Scan the webapps directory for recently modified or created JSP files
find /opt/ManageEngine/ServiceDesk/webapps/ -name '*.jsp' -mtime -30 -ls

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

This vulnerability is actively exploited in the wild; immediately restrict external access and apply the official vendor patches.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-44077) is a critical security flaw residing in the servlet mapping and Struts configuration of Zoho ManageEngine products. The root cause is a missing authentication check (CWE-306) for /RestAPI URLs and the ImportTechnicians action in the Struts configuration. This allows unauthenticated remote attackers to directly access sensitive internal API endpoints without any credential verification.

2. Exploitation Mechanics & Attack Scenario

An attacker exploits this vulnerability by sending a crafted HTTP POST request to the /RestAPI/ImportTechnicians or related servlet endpoints. Because the application fails to validate the user's session, it processes the request and allows arbitrary file uploads. By uploading an executable payload (such as a JSP web shell) and accessing it via the web root, the attacker achieves arbitrary remote code execution (RCE) under the context of the running application.

3. Infrastructure & Business Impact

With a CVSS score of 9.8 (Critical) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk to enterprise environments. Successful exploitation can lead to complete domain compromise, Active Directory credential theft, lateral movement across the internal network, and deployment of ransomware, resulting in catastrophic business disruption.

Official Vendor Advisories & References

NVD Original English Description

Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.

http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html

Source: cve@mitre.org · Exploit, Third Party Advisory, VDB Entry

https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-authentication-bypass-vulnerability-in-servicedesk-plus-versions-11138-and-above

Source: cve@mitre.org · Patch, Vendor Advisory

https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-msp-versions-10527-till-10529

Source: cve@mitre.org · Vendor Advisory

https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-servicedesk-plus-versions-up-to-11305-22-11-2021

Source: cve@mitre.org · Vendor Advisory

https://pitstop.manageengine.com/portal/en/community/topic/security-advisory-for-cve-2021-44077-unauthenticated-rce-vulnerability-in-supportcenter-plus-versions-11012-and-11013

Source: cve@mitre.org · Vendor Advisory

http://packetstormsecurity.com/files/165400/ManageEngine-ServiceDesk-Plus-Remote-Code-Execution.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Exploit, Third Party Advisory, VDB Entry

Frequently Asked SecOps Questions (CVE-2021-44077)

FAQ

Q1. How critical is CVE-2021-44077 and is it actively exploited in the wild?

CVE-2021-44077 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 93.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-44077?

Primary impacted vendors include zoho across manageengine servicedesk plus, manageengine servicedesk plus msp, manageengine supportcenter plus. Scope summary: Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014

Q3. What temporary mitigations or workarounds exist for CVE-2021-44077 before patching?

[Mitigation] Immediately apply the official vendor patches, restrict external access to vulnerable endpoints, and perform a comprehensive log audit for Indicators of Compromise (IoCs). Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION