TI-2021-20117 Aliases CVE-2021-44515 GHSA-wrwj-r75g-4vx9

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to…

CRITICAL 100Exploited in the wildPublished 2021-12-12 · Updated 2025-10-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.

Why it matters now

Exploitation Active In CISA KEV since 2021-12-10CISA due date 2021-12-24

EPSS 0.99871 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:zohocorp:manageengine_desktop_central:::::enterprise:::*	before 10.1.2127.18	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_desktop_central:::::managed_service_providers:::*	before 10.1.2127.18	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_desktop_central:::::enterprise:::*	10.1.2128.0 to before 10.1.2137.3	Vulnerable	Zohocorp
cpe:2.3:a:zohocorp:manageengine_desktop_central:::::managed_service_providers:::*	10.1.2128.0 to before 10.1.2137.3	Vulnerable	Zohocorp

cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:enterprise:*:*:* Versions before 10.1.2127.18 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:managed_service_providers:*:*:* Versions before 10.1.2127.18 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:enterprise:*:*:* Versions 10.1.2128.0 to before 10.1.2137.3 Vulnerable ·Zohocorp
cpe:2.3:a:zohocorp:manageengine_desktop_central:*:*:*:*:managed_service_providers:*:*:* Versions 10.1.2128.0 to before 10.1.2137.3 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

2021-12-10 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2021-44515
2026-10-03 Alias added: GHSA-wrwj-r75g-4vx9

References

Exploit 1

https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html

Advisory 2

TI-2022-23765 Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003… KEVCVSS 3.1CRITICAL 9.8
TI-2022-15981 Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… KEVCVSS 3.1CRITICAL 9.8
TI-2021-19808 Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and… KEVCVSS 3.1CRITICAL 9.8
TI-2021-17574 Zoho ManageEngine ADSelfService Plus version 6113 and prior is vulnerable to REST API… KEVCVSS 3.1CRITICAL 9.8
TI-2021-15358 Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass… KEVCVSS 3.1CRITICAL 9.8
TI-2020-08210 Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of… KEVCVSS 3.1CRITICAL 9.8

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences