Read the docs
TI-2021-20187 Aliases CVE-2021-44650GHSA-r94f-5mf3-7vp2

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution…

Priority LOW 39Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

Zoho ManageEngine M365 Manager Plus before Build 4419 allows remote command execution when updating proxy settings through the Admin ProxySettings and Tenant ProxySettings components.

Why it matters now

EPSS 0.04951 92nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 18

CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:*:*:*:*:*:*:*:*before 4.4VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:-:*:*:*:*:*:*4.4VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4400:*:*:*:*:*:*4.4 build4400VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4401:*:*:*:*:*:*4.4 build4401VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4402:*:*:*:*:*:*4.4 build4402VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4403:*:*:*:*:*:*4.4 build4403VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4406:*:*:*:*:*:*4.4 build4406VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4407:*:*:*:*:*:*4.4 build4407VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4408:*:*:*:*:*:*4.4 build4408VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4410:*:*:*:*:*:*4.4 build4410VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:*:*:*:*:*:*:*:* Versions before 4.4 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:-:*:*:*:*:*:* Versions 4.4 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4400:*:*:*:*:*:* Versions 4.4 build4400 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4401:*:*:*:*:*:* Versions 4.4 build4401 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4402:*:*:*:*:*:* Versions 4.4 build4402 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4403:*:*:*:*:*:* Versions 4.4 build4403 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4406:*:*:*:*:*:* Versions 4.4 build4406 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4407:*:*:*:*:*:* Versions 4.4 build4407 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4408:*:*:*:*:*:* Versions 4.4 build4408 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4410:*:*:*:*:*:* Versions 4.4 build4410 Vulnerable ·Zohocorp
Show 8 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4411:*:*:*:*:*:*4.4 build4411VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4412:*:*:*:*:*:*4.4 build4412VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4413:*:*:*:*:*:*4.4 build4413VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4414:*:*:*:*:*:*4.4 build4414VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4415:*:*:*:*:*:*4.4 build4415VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4416:*:*:*:*:*:*4.4 build4416VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4417:*:*:*:*:*:*4.4 build4417VulnerableZohocorp
cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4418:*:*:*:*:*:*4.4 build4418VulnerableZohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4411:*:*:*:*:*:* Versions 4.4 build4411 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4412:*:*:*:*:*:* Versions 4.4 build4412 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4413:*:*:*:*:*:* Versions 4.4 build4413 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4414:*:*:*:*:*:* Versions 4.4 build4414 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4415:*:*:*:*:*:* Versions 4.4 build4415 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4416:*:*:*:*:*:* Versions 4.4 build4416 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4417:*:*:*:*:*:* Versions 4.4 build4417 Vulnerable ·Zohocorp
  • cpe:2.3:a:zohocorp:manageengine_m365_manager_plus:4.4:build4418:*:*:*:*:*:* Versions 4.4 build4418 Vulnerable ·Zohocorp

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-44650
  2. 2026-10-03 Alias added: GHSA-r94f-5mf3-7vp2

References

Advisory 1

  • TI-2021-18608 Zoho ManageEngine M365 Manager Plus before 4421 is vulnerable to file-upload remote code execution. CVSS 3.1CRITICAL 9.8
  • TI-2023-17875 Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and… CVSS 3.1HIGH 8.1
  • TI-2023-05614 ManageEngine Information Disclosure in Multiple Products CVSS 3.1MEDIUM 5.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences