CVE-2021-3287

What it actually does

CVE-2021-3287 is an unauthenticated remote code execution flaw in Zoho ManageEngine OpManager caused by an unsafe Java deserialization path combined with a general authentication bypass. A remote attacker can send a crafted serialized object to an exposed OpManager service and cause the application server to deserialize attacker-controlled data. If a usable gadget chain is present in the OpManager Java classpath, deserialization can invoke arbitrary operating system commands with the privileges of the OpManager service account. Because the vulnerability is network-reachable, requires no credentials, and has low exploitation complexity, successful exploitation can lead to full compromise of the OpManager host, including confidentiality, integrity, and availability impact.

Why it matters to the business

OpManager is commonly deployed as a privileged network monitoring platform with broad visibility into infrastructure, credentials, device inventories, and alerting workflows. Compromise of this system can give attackers a high-value foothold for lateral movement, credential theft, monitoring blind spots, tampering with operational telemetry, and disruption of network operations. The CVSS score is critical and the EPSS probability is high, with weaponized exploit maturity, so internet-facing or broadly reachable OpManager instances should be treated as urgent exposure even though this CVE is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a reachable ManageEngine OpManager instance, often by scanning for exposed OpManager web ports and product-specific response headers, login pages, static assets, or service banners. The attacker then sends a crafted unauthenticated request containing a malicious Java serialized object to the vulnerable deserialization handling path. The authentication bypass allows the request to reach code that should not be accessible to an anonymous user. During deserialization, the malicious object triggers a gadget chain available in the application classpath, causing the Java process running OpManager to execute attacker-supplied commands. Initial commands commonly verify execution, retrieve a second-stage payload, create a web shell, add a user, deploy a reverse shell, or run reconnaissance. Once code execution is established, the attacker may dump configuration files, search for stored credentials, tamper with monitoring data, pivot to managed devices, or deploy persistence on the OpManager server.

How to fix it

Upgrade Zoho ManageEngine OpManager to version 12.5.329 or later. If an immediate upgrade is not possible, restrict network access to OpManager to trusted administration networks only, block public internet access, place the service behind VPN or strong access controls, and enforce firewall allowlists for management ports. Run OpManager with the least-privileged service account possible and review any stored credentials or device access keys because a successful exploit may expose them. After patching, restart the OpManager services to ensure vulnerable classes are no longer loaded. If exploitation is suspected, treat the server as potentially compromised: isolate it, preserve logs and disk artifacts, rotate credentials stored in or accessible by OpManager, rebuild from trusted media if necessary, and review managed devices for follow-on activity.

How to confirm the fix worked

Confirm the installed OpManager version is 12.5.329 or later using the product UI, build information page, installation metadata, or vendor-supported version command. Verify that OpManager is not reachable from untrusted networks or the public internet unless explicitly required and protected by compensating controls. Perform an authenticated configuration review to ensure administrative access is limited and service accounts are least-privileged. Use vulnerability scanners or safe version-detection checks to confirm that no OpManager instance older than 12.5.329 remains exposed. After upgrade, retest that previously exposed unauthenticated deserialization paths no longer accept crafted serialized input and that requests fail safely without command execution or Java deserialization errors.

Typical attack path

1. Scan for exposed Zoho ManageEngine OpManager services and identify versions older than 12.5.329.
2. Send an unauthenticated crafted HTTP request containing a malicious Java serialized payload.
3. Abuse the authentication bypass so the request reaches the vulnerable deserialization class.
4. Trigger Java deserialization of attacker-controlled data and execute operating system commands through a gadget chain.
5. Run command-execution probes such as whoami, id, hostname, ping, nslookup, or curl to confirm exploitation.
6. Download or stage a web shell, reverse shell, remote access tool, or additional payload.
7. Collect OpManager configuration data, credentials, device inventories, and network topology information.
8. Use the compromised monitoring server for lateral movement, persistence, data theft, or operational disruption.

How to detect it

Review OpManager web access logs, application logs, wrapper/service logs, Java stdout/stderr logs, reverse proxy logs, EDR process telemetry, and network flow records for signs of unauthenticated exploit attempts and post-exploitation activity. Focus on unusual POST requests to OpManager endpoints, requests with binary Java serialized content, requests from unknown scanners, deserialization stack traces, and HTTP requests immediately followed by outbound connections from the OpManager server. On the host, look for the OpManager Java process spawning cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe, bitsadmin.exe, curl, wget, bash, sh, nc, perl, python, or other command interpreters and download tools. Search for newly created files in OpManager web directories, temporary directories, startup locations, and script directories. Investigate command-execution probes such as whoami, hostname, id, ipconfig, ifconfig, net user, ping, nslookup, curl, and wget launched by the OpManager service account. Also review authentication, admin-user creation, configuration export, credential access, and device-management events after any suspicious request. Because exploitation may result in full server compromise, absence of a single known IOC is not sufficient to rule out compromise; correlate web, application, endpoint, and network evidence.

• AC ED 00 05
• java.io.StreamCorruptedException
• java.io.InvalidClassException
• java.io.ObjectInputStream
• org.apache.commons.collections.functors.InvokerTransformer
• com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl
• ysoserial
• cmd.exe /c
• powershell -enc
• powershell -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer
• /bin/sh -c
• bash -c
• wget http
• curl http
• whoami
• hostname
• nslookup
• C:\ManageEngine\OpManager\logs\wrapper.log
• C:\ManageEngine\OpManager\logs\serverout
• /opt/ManageEngine/OpManager/logs/wrapper.log
• /opt/ManageEngine/OpManager/logs/serverout
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java spawning /bin/sh
• java spawning bash

What your security team should do

• Immediately inventory all Zoho ManageEngine OpManager deployments, including internet-facing, internal, test, and disaster-recovery instances.
• Prioritize upgrading all instances older than 12.5.329, especially those reachable from the internet or broad internal networks.
• Temporarily restrict access to OpManager management interfaces using firewall rules, VPN, reverse proxy controls, or network segmentation until patching is complete.
• Hunt for prior exploitation in OpManager logs, Java service logs, web access logs, endpoint telemetry, and network telemetry going back at least to the first known exposure window.
• Investigate any OpManager Java process spawning operating system shells, scripting engines, download utilities, or network utilities.
• Rotate credentials stored in OpManager or used by OpManager to monitor network devices, servers, databases, and cloud services if compromise cannot be ruled out.
• Review managed devices and adjacent infrastructure for lateral movement originating from the OpManager server.
• Add SIEM detections for Java serialized payload markers, deserialization exceptions, unauthenticated anomalous requests to OpManager, and suspicious child processes from the OpManager Java runtime.
• Ensure OpManager servers are monitored by EDR and that logs are forwarded off-host to prevent attacker tampering.