CVE-2021-37415VulnerabilityPublished 12/01/2021Updated 10/24/2026

CVE-2021-37415: Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Affects Zoho ManageEngine ServiceDesk Plus (SDP)Source CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 12/01/2021
KEV deadline: 12/15/2021
EPSS: 99.8% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-37415 (opens in a new tab)

Description

Zoho ManageEngine ServiceDesk Plus versions before 11302 contain an authentication bypass vulnerability that allows certain REST-API URLs to be accessed without authentication. This flaw enables unauthorized users to potentially interact with the service desk application without proper credentials. The vulnerability has been exploited in the wild, indicating active use by attackers. No explicit patch information is provided in the input data.

Summary

CVE-2021-37415 is an authentication bypass vulnerability in Zoho ManageEngine ServiceDesk Plus prior to version 11302. The vulnerability permits access to some REST-API endpoints without requiring authentication, which could allow unauthorized access to the application. This issue is classified under CWE-306 (Missing Authentication for Critical Function). Exploitation of this vulnerability has been observed in the wild. The input data does not specify the exact affected versions or patch availability.

Impact

The authentication bypass vulnerability allows unauthorized users to access certain REST-API URLs without authentication, potentially exposing sensitive service desk functions or data. Given that exploitation is known in the wild, this poses a significant security risk to affected deployments.

Mitigation

The input data does not provide explicit patch or remediation information. Since the vulnerability affects versions before 11302, upgrading to version 11302 or later is likely recommended. Users should consult the vendor advisory for official patch and mitigation guidance. Until patched, restricting network access to the affected service and monitoring for suspicious API activity may help reduce risk.

Weaknesses

CWE-306Missing Authentication for Critical Function (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:55:34 UTC

Weaknesses

References

Related threats