Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers…
Priority CRITICAL 90Exploited in the wildCWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-434.
Summary
Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.
Why it matters now
Exploitation Active In CISA KEV since 2021-11-03CISA due date 2022-05-03
EPSS 0.63336 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA and NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Active
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:* | before 10.0.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:-:*:*:*:*:*:* | 10.0.0 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10000:*:*:*:*:*:* | 10.0.0 10000 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10001:*:*:*:*:*:* | 10.0.0 10001 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10002:*:*:*:*:*:* | 10.0.0 10002 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10003:*:*:*:*:*:* | 10.0.0 10003 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10004:*:*:*:*:*:* | 10.0.0 10004 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10005:*:*:*:*:*:* | 10.0.0 10005 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10006:*:*:*:*:*:* | 10.0.0 10006 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10007:*:*:*:*:*:* | 10.0.0 10007 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:*:*:*:*:*:*:*:* Versions before 10.0.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:-:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10000:*:*:*:*:*:* Versions 10.0.0 10000 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10001:*:*:*:*:*:* Versions 10.0.0 10001 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10002:*:*:*:*:*:* Versions 10.0.0 10002 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10003:*:*:*:*:*:* Versions 10.0.0 10003 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10004:*:*:*:*:*:* Versions 10.0.0 10004 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10005:*:*:*:*:*:* Versions 10.0.0 10005 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10006:*:*:*:*:*:* Versions 10.0.0 10006 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10007:*:*:*:*:*:* Versions 10.0.0 10007 Vulnerable ·Zohocorp
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10008:*:*:*:*:*:* | 10.0.0 10008 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10009:*:*:*:*:*:* | 10.0.0 10009 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10010:*:*:*:*:*:* | 10.0.0 10010 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10011:*:*:*:*:*:* | 10.0.0 10011 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10008:*:*:*:*:*:* Versions 10.0.0 10008 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10009:*:*:*:*:*:* Versions 10.0.0 10009 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10010:*:*:*:*:*:* Versions 10.0.0 10010 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus:10.0.0:10011:*:*:*:*:*:* Versions 10.0.0 10011 Vulnerable ·Zohocorp
Remediation
No fixed version listed by the sources yet.
Timeline
- 2021-11-03 Added to CISA KEV
- 2026-10-02 Threatist record created from CVE-2019-8394
- 2026-10-03 Alias added: GHSA-grv7-685f-m26h
References
Exploit 1
More Zoho vulnerabilities
- TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
- TI-2022-15981 Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-20117 Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
- TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8
Sources
- CVE-2019-8394 · CVE Program
- CVE-2019-8394 · NVD
- CISA Known Exploited Vulnerabilities
- FIRST EPSS
- GHSA-grv7-685f-m26h · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences