Read the docs
TI-2021-19053 Aliases CVE-2021-42954GHSA-5984-mr35-258v

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected…

Priority LOW 34CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group (non-admin or any guest users), thereby allowing privilege escalation, unauthorized password reset, stealing of sensitive data, access to credentials in plaintext, access to registry values, tampering with configuration files, etc.

Why it matters now

EPSS 0.00392 33rd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_remote_access_plus:*:*:*:*:*:*:*:*before 10.1.2121.1VulnerableZohocorp
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:zohocorp:manageengine_remote_access_plus:*:*:*:*:*:*:*:* Versions before 10.1.2121.1 Vulnerable ·Zohocorp
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42954
  2. 2026-10-03 Alias added: GHSA-5984-mr35-258v

References

Exploit 1

  • TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
  • TI-2020-12264 A design issue was discovered in GetInternetRequestHandle, InternetSendRequestEx and… CVSS 3.1HIGH 8.1
  • TI-2019-08483 Zoho ManageEngine Remote Access Plus 10.0.258 does not validate user permissions… CVSS 3.1HIGH 8.8
  • TI-2021-18451 Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials associated with resetPWD.xml. CVSS 3.1HIGH 7.5
  • TI-2021-18450 Zoho ManageEngine Remote Access Plus before 10.1.2121.1 has hardcoded credentials for… CVSS 3.1HIGH 7.5
  • TI-2021-18452 Zoho ManageEngine Remote Access Plus before 10.1.2121.1 relies on the application's build… CVSS 3.1HIGH 7.5
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences