CVE-2021-31160: Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data
Source CVE Database V5
Not known to be exploited · fixed in 10521 : patch affected systems soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA
- EPSS
- 3.5% chance of exploitation in 30 days – higher than 89% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 10521
Exploitation evidence
Disclosed: evidence found.
CVE published 29 Jun 2021
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | Affected
| Fixed in
|
AI-suggested
Organizations using ManageEngine ServiceDesk Plus MSP should prioritize upgrading to version 10521 or later, where this vulnerability is addressed. In the absence of immediate patch availability, organizations should implement strict network segmentation to isolate the ServiceDesk Plus MSP environment from other critical systems and limit access to trusted personnel only. Monitoring and logging access to the ServiceDesk Plus MSP should be enhanced to detect any unauthorized or anomalous access attempts promptly. Employing strong authentication mechanisms, such as multi-factor authentication (MFA), can reduce the risk of unauthorized access. Additionally, conducting regular security audits and vulnerability assessments on the MSP environment can help identify and remediate potential weaknesses. Organizations should also review and enforce least privilege principles for user accounts within the ServiceDesk Plus MSP system to minimize exposure.
Description
Zoho ManageEngine ServiceDesk Plus MSP before 10521 allows an attacker to access internal data.