CVE-2021-44757

—

CVSS 3.1

9.1 critical

EPSS

24%p98

Published

Jan 18, 2022 (Jan 18, 2022)

Modified

Jun 17, 2026

Description

Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server.

Vendors: zohocorp
Products: manageengine desktop central, manageengine desktop central managed service providers
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (24.2%)

In the news2 stories

Zoho Releases Patch for Critical Flaw Affecting ManageEngine Desktop Central

The Hacker NewsJan 18, 10:03 UTC · Jan 18, 2022Vulnerability CVE-2021-44757 CVE-2021-40539 CVE-2021-44077+1 CVEs

Zoho fixes a critical vulnerability (CVE-2021

Security AffairsJan 17, 20:42 UTC · Jan 17, 2022Vulnerability in the wildCVE-2021-44757 CVE-2021-44515