Endpoint VulnerabilityManageEngine ServiceDesk Plus CVE-2021-44077 Remote Code Execution Vulnerability
Description
Unauthenticated remote code execution via /RestAPI URLs in a servlet and ImportTechnicians Struts configuration affects Zoho ManageEngine ServiceDesk Plus (<=11305), ServiceDesk Plus MSP (<=10529), and SupportCenter Plus (<=11013).
Outbreak Alert
APT Actors are actively exploiting Zoho ManageEngine ServiceDesk Plus which is an IT help desk software with asset management. The exploit is tracked via CVE-2021-44077 and rated critical due to its capability for unauthenticated remote code execution (RCE).
Affected Applications
ManageEngine ServiceDesk Plus
Version Updates
| ID | 4965 |
| Created | Apr 28, 2023 |
| Description Updated |
Jan 16, 2026 |
| CVE ID | |
| Tags | Zoho Exploit Threat Signal |
| Risk |
|
| Coverage | FortiClient |
| OS | Windows |
| Vendor | Zoho |
| Patch | manual |
| Application | ManageEngine ServiceDesk Plus |