Read the docs
TI-2021-18456 Aliases CVE-2021-41833GHSA-8h8p-qpmp-fmvf

Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.

Priority MEDIUM 53CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-434.

Summary

Zoho ManageEngine Patch Connect Plus before 90099 is vulnerable to unauthenticated remote code execution.

Why it matters now

EPSS 0.08012 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 39

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:*:*:*:*:*:*:*:*before 9.0.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:-:*:*:*:*:*:*9.0.0VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90001:*:*:*:*:*:*9.0.0 build90001VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90063:*:*:*:*:*:*9.0.0 build90063VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90064:*:*:*:*:*:*9.0.0 build90064VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90065:*:*:*:*:*:*9.0.0 build90065VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90066:*:*:*:*:*:*9.0.0 build90066VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90067:*:*:*:*:*:*9.0.0 build90067VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90068:*:*:*:*:*:*9.0.0 build90068VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90069:*:*:*:*:*:*9.0.0 build90069VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:*:*:*:*:*:*:*:* Versions before 9.0.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:-:*:*:*:*:*:* Versions 9.0.0 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90001:*:*:*:*:*:* Versions 9.0.0 build90001 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90063:*:*:*:*:*:* Versions 9.0.0 build90063 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90064:*:*:*:*:*:* Versions 9.0.0 build90064 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90065:*:*:*:*:*:* Versions 9.0.0 build90065 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90066:*:*:*:*:*:* Versions 9.0.0 build90066 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90067:*:*:*:*:*:* Versions 9.0.0 build90067 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90068:*:*:*:*:*:* Versions 9.0.0 build90068 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90069:*:*:*:*:*:* Versions 9.0.0 build90069 Vulnerable ·Zohocorp
Show 29 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90070:*:*:*:*:*:*9.0.0 build90070VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90071:*:*:*:*:*:*9.0.0 build90071VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90072:*:*:*:*:*:*9.0.0 build90072VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90073:*:*:*:*:*:*9.0.0 build90073VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90074:*:*:*:*:*:*9.0.0 build90074VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90075:*:*:*:*:*:*9.0.0 build90075VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90076:*:*:*:*:*:*9.0.0 build90076VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90077:*:*:*:*:*:*9.0.0 build90077VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90078:*:*:*:*:*:*9.0.0 build90078VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90079:*:*:*:*:*:*9.0.0 build90079VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90080:*:*:*:*:*:*9.0.0 build90080VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90081:*:*:*:*:*:*9.0.0 build90081VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90082:*:*:*:*:*:*9.0.0 build90082VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90083:*:*:*:*:*:*9.0.0 build90083VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90084:*:*:*:*:*:*9.0.0 build90084VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90085:*:*:*:*:*:*9.0.0 build90085VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90086:*:*:*:*:*:*9.0.0 build90086VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90087:*:*:*:*:*:*9.0.0 build90087VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90088:*:*:*:*:*:*9.0.0 build90088VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90089:*:*:*:*:*:*9.0.0 build90089VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90090:*:*:*:*:*:*9.0.0 build90090VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90091:*:*:*:*:*:*9.0.0 build90091VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90092:*:*:*:*:*:*9.0.0 build90092VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90093:*:*:*:*:*:*9.0.0 build90093VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90094:*:*:*:*:*:*9.0.0 build90094VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90095:*:*:*:*:*:*9.0.0 build90095VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90096:*:*:*:*:*:*9.0.0 build90096VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90097:*:*:*:*:*:*9.0.0 build90097VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90098:*:*:*:*:*:*9.0.0 build90098VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90070:*:*:*:*:*:* Versions 9.0.0 build90070 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90071:*:*:*:*:*:* Versions 9.0.0 build90071 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90072:*:*:*:*:*:* Versions 9.0.0 build90072 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90073:*:*:*:*:*:* Versions 9.0.0 build90073 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90074:*:*:*:*:*:* Versions 9.0.0 build90074 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90075:*:*:*:*:*:* Versions 9.0.0 build90075 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90076:*:*:*:*:*:* Versions 9.0.0 build90076 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90077:*:*:*:*:*:* Versions 9.0.0 build90077 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90078:*:*:*:*:*:* Versions 9.0.0 build90078 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90079:*:*:*:*:*:* Versions 9.0.0 build90079 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90080:*:*:*:*:*:* Versions 9.0.0 build90080 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90081:*:*:*:*:*:* Versions 9.0.0 build90081 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90082:*:*:*:*:*:* Versions 9.0.0 build90082 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90083:*:*:*:*:*:* Versions 9.0.0 build90083 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90084:*:*:*:*:*:* Versions 9.0.0 build90084 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90085:*:*:*:*:*:* Versions 9.0.0 build90085 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90086:*:*:*:*:*:* Versions 9.0.0 build90086 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90087:*:*:*:*:*:* Versions 9.0.0 build90087 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90088:*:*:*:*:*:* Versions 9.0.0 build90088 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90089:*:*:*:*:*:* Versions 9.0.0 build90089 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90090:*:*:*:*:*:* Versions 9.0.0 build90090 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90091:*:*:*:*:*:* Versions 9.0.0 build90091 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90092:*:*:*:*:*:* Versions 9.0.0 build90092 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90093:*:*:*:*:*:* Versions 9.0.0 build90093 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90094:*:*:*:*:*:* Versions 9.0.0 build90094 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90095:*:*:*:*:*:* Versions 9.0.0 build90095 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90096:*:*:*:*:*:* Versions 9.0.0 build90096 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90097:*:*:*:*:*:* Versions 9.0.0 build90097 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_patch_connect_plus:9.0.0:build90098:*:*:*:*:*:* Versions 9.0.0 build90098 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-41833
  2. 2026-10-03 Alias added: GHSA-8h8p-qpmp-fmvf

References

Patch 1

Advisory 1

  • TI-2019-09057 Multiple Zoho ManageEngine products suffer from local privilege escalation due to… CVSS 3.0HIGH 7.8
  • TI-2023-05614 ManageEngine Information Disclosure in Multiple Products CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences