Local File Inclusion
Priority LOW 32CWE-434Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-434.
Summary
Zohocorp ManageEngine ServiceDesk Plus MSP and SupportCenter Plus versions below 14920 are vulnerable to authenticated Local File Inclusion (LFI) in the Admin module, where help card content is loaded.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01645 76th percentileScored 2026-11-07
Fix Fixed ServiceDesk Plus MSP (ManageEngine): 14920SupportCenter Plus (ManageEngine): 14920
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| ManageEngine | ServiceDesk Plus MSP | before 14920 | 14920 | Patch available | CNA |
| ManageEngine | SupportCenter Plus | before 14920 | 14920 | Patch available | CNA |
- ServiceDesk Plus MSP VendorManageEngine Affected before 14920 Fixed in 14920 Patch available CNA
- SupportCenter Plus VendorManageEngine Affected before 14920 Fixed in 14920 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:* | up to 14.8 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.9:14900:*:*:*:*:*:* | 14.9 14900 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.9:14910:*:*:*:*:*:* | 14.9 14910 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:* | up to 14.8 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.9:14900:*:*:*:*:*:* | 14.9 14900 | Vulnerable | Zohocorp |
| cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.9:14910:*:*:*:*:*:* | 14.9 14910 | Vulnerable | Zohocorp |
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:*:*:*:*:*:*:*:* Versions up to 14.8 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.9:14900:*:*:*:*:*:* Versions 14.9 14900 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_servicedesk_plus_msp:14.9:14910:*:*:*:*:*:* Versions 14.9 14910 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:*:*:*:*:*:*:*:* Versions up to 14.8 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.9:14900:*:*:*:*:*:* Versions 14.9 14900 Vulnerable ·Zohocorp
- cpe:2.3:a:zohocorp:manageengine_supportcenter_plus:14.9:14910:*:*:*:*:*:* Versions 14.9 14910 Vulnerable ·Zohocorp
Remediation
- Fix · CNA ServiceDesk Plus MSP (ManageEngine) Fixed in 14920
- Fix · CNA SupportCenter Plus (ManageEngine) Fixed in 14920
Timeline
- 2026-10-02 Threatist record created from CVE-2025-3444
- 2026-10-03 Alias added: GHSA-mjxx-858f-xw63
References
More ManageEngine vulnerabilities
- TI-2015-06796 The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows… CVSS 3.0CRITICAL 9.8
- TI-2014-04325 Directory traversal vulnerability in ServiceDesk Plus MSP v5 to v9.0 v9030; AssetExplorer… CVSS 3.0HIGH 8.8
- TI-2017-08514 Path traversal in Zoho ManageEngine ServiceDesk CVSS 3.0HIGH 7.5
- TI-2023-25530 Path traversal in ManageEngine OpManager CVSS 3.1CRITICAL 9.1
- TI-2025-03383 SQL injection in ManageEngine ADSelfService Plus CVSS 3.1HIGH 8.1
- TI-2025-24864 SQL injection in ManageEngine ADAudit Plus CVSS 3.1HIGH 8.3
Sources
- CVE-2025-3444 · CVE Program
- CVE-2025-3444 · NVD
- FIRST EPSS
- GHSA-mjxx-858f-xw63 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences