{"id":"CVE-2021-44515","published":"2021-12-12T05:15:07Z","modified":"2026-06-17T04:12:29Z","title":"Zoho Desktop Central Authentication Bypass Vulnerability","vendor":"Zoho","product":"Desktop Central","tier":"core","eol":null,"description":{"text":"Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.","provenance":"source","from":"NVD"},"summary":{"text":"Zoho ManageEngine Desktop Central, the Zoho desktop management product, contains an authentication bypass flaw in its server component. An unauthenticated attacker with network access to the server can exploit this bypass to achieve remote code execution, with no user interaction or prior credentials required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:09:30Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99871,"percentile":0.99963,"date":"2026-10-31","provenance":"source"},"kev":{"dateAdded":"2021-12-10","dueDate":"2021-12-24","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2021-44515","provenance":"source"},"vulncheckKev":{"dateAdded":"2021-12-10","exploitedFirstSeen":"2021-12-10","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-12-10"},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44515","date":"2021-12-12"},{"url":"https://www.ic3.gov/Media/News/2021/211220.pdf","date":"2021-12-17"},{"url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2022GTR.pdf","date":"2022-02-15"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-24&host_type=src&vulnerability=cve-2021-44515","date":"2026-03-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-25&host_type=src&vulnerability=cve-2021-44515","date":"2026-03-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-03-30&host_type=src&vulnerability=cve-2021-44515","date":"2026-03-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-04-06&host_type=src&vulnerability=cve-2021-44515","date":"2026-04-06"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-04-08&host_type=src&vulnerability=cve-2021-44515","date":"2026-04-08"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-04-09&host_type=src&vulnerability=cve-2021-44515","date":"2026-04-09"}],"evidenceTotal":144,"provenance":"source"},"exploited":true,"otx":null,"cwes":[],"references":[{"url":"https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog","tags":["Broken Link","Third Party Advisory","US Government Resource"]},{"url":"https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://pitstop.manageengine.com/portal/en/community/topic/an-authentication-bypass-vulnerability-identified-and-fixed-in-desktop-central-and-desktop-central-msp","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://www.cisa.gov/uscert/ncas/current-activity/2021/12/10/cisa-adds-thirteen-known-exploited-vulnerabilities-catalog","tags":["Broken Link","Third Party Advisory","US Government Resource"]},{"url":"https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html","tags":["Exploit","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44515","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ","confidence":"high"},{"id":"T1105","name":"Ingress Tool Transfer","tactics":["command-and-control"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"primary_impact","evidence":[],"comment":"CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ","confidence":"high"},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ","confidence":"high"},{"id":"T1069","name":"Permission Groups Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ","confidence":"high"},{"id":"T1087","name":"Account Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Authentication Bypass","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2021-44515 is an authentication bypass vulnerability. Post-exploit, APT actors were observed dropping a webshell, downloading post-exploitation tools, enumerating\ndomain users and groups, conducting network reconnaissance, attempting lateral movement and dumping credentials. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-31348","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-31348","exploited":true,"exploitedSince":"2021-12-10","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2021-44515","name":"Zoho ManageEngine Desktop Central - Remote Code Execution","severity":"critical","path":"http/cves/2021/CVE-2021-44515.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-44515.yaml"}],"provenance":"source"},"exploitRefs":["https://www.manageengine.com/products/desktop-central/cve-2021-44515-authentication-bypass-filter-configuration.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1105"],"provenance":"source"},{"stage":"secondary","techniques":["T1003","T1069","T1087"],"provenance":"source"}],"timeline":[{"date":"2021-12-10","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2021-12-10","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-12-10","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-31348","provenance":"source"},{"date":"2021-12-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44515","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":66.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1787 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9996"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}