CVE-2021-31530: Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure
Source CVE Database V5
Not known to be exploited · fixed in 10522 : patch affected systems soon.
Data as of 26 Oct 2026, 14:05 UTC
Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA
- EPSS
- 2.7% chance of exploitation in 30 days – higher than 86% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 10522
Exploitation evidence
Disclosed: evidence found.
CVE published 29 Jun 2021
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n/a n/a | Affected
| Fixed in
|
AI-suggested
European organizations should prioritize upgrading ManageEngine ServiceDesk Plus MSP to version 10522 or later, where the vulnerability is addressed. In the absence of an official patch, organizations should implement strict network segmentation to limit access to the ServiceDesk Plus MSP interface, enforce strong authentication mechanisms including multi-factor authentication, and monitor logs for unusual access patterns indicative of exploitation attempts. Regularly auditing user permissions and minimizing the exposure of the management interface to the internet can reduce attack surface. Additionally, organizations should conduct internal security assessments and penetration testing focused on the ServiceDesk Plus MSP deployment to identify any residual risks. Maintaining up-to-date backups and incident response plans will also help mitigate the impact in case of a breach. Finally, staying informed through vendor advisories and threat intelligence feeds is essential to respond promptly to any emerging exploit developments.
Description
Zoho ManageEngine ServiceDesk Plus MSP before 10522 is vulnerable to Information Disclosure.