CVE-2021-44077

What it actually does

This vulnerability allows unauthenticated remote code execution in affected Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus instances. The flaw is tied to exposed /RestAPI servlet handling and the ImportTechnicians Struts action, allowing an attacker to reach functionality that should require authentication and cause server-side code or commands to execute. Successful exploitation can give the attacker control in the context of the ManageEngine application service account, enabling data access, web shell deployment, lateral movement tooling, credential theft, and service disruption.

Why it matters to the business

A vulnerable internet-facing help desk or support platform can be taken over without valid credentials. Because these systems often contain user records, tickets, attachments, infrastructure details, internal communications, and administrative integrations, compromise can lead to data theft, operational disruption, credential exposure, and follow-on compromise of other business systems. This issue is listed in CISA KEV, had a remediation due date of 2021-12-15, has active exploitation maturity, and has a very high EPSS score, so any remaining exposure should be treated as urgent and potentially already targeted.

How an attack unfolds

An attacker first identifies an exposed ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, or SupportCenter Plus instance. They then send crafted unauthenticated HTTP requests to the affected /RestAPI servlet path, abusing the ImportTechnicians Struts action that is improperly reachable without authentication. If the target is running a vulnerable build, the request can trigger server-side execution of attacker-controlled content or commands. After initial code execution, the attacker commonly attempts to establish persistence by writing a web shell or executable under the application directory, runs discovery commands, dumps or accesses application data, harvests credentials or configuration secrets, and may use the compromised server as a pivot point into connected identity, ticketing, endpoint management, or internal network resources.

How to fix it

Upgrade affected products to fixed or later builds: ManageEngine ServiceDesk Plus 11306 or later, ManageEngine ServiceDesk Plus MSP 10530 or later, and ManageEngine SupportCenter Plus 11014 or later. If immediate upgrade is not possible, remove public internet exposure, restrict access to trusted administrative networks or VPN, block unauthenticated access to suspicious /RestAPI paths at a reverse proxy or WAF where feasible, and monitor for exploit attempts. Because this vulnerability has been actively exploited, remediation should include compromise assessment, not only patching. Rotate credentials and secrets accessible to the application if exploitation is suspected or cannot be ruled out.

How to confirm the fix worked

Confirm the installed product and build number from the ManageEngine administrative console, version files, or application startup logs and verify it is at or above the fixed release for the product line. Review internet-facing asset inventories, external attack surface management results, firewall NAT rules, and reverse proxy configurations to confirm no vulnerable instance remains exposed. Validate that unauthenticated requests to sensitive /RestAPI and ImportTechnicians-related endpoints are rejected or unavailable. After upgrade, review vendor release notes and confirm the application service restarted cleanly. Perform file integrity checks and log review to ensure there are no web shells, unexpected executables, or suspicious post-exploitation artifacts left behind.

Typical attack path

1. Scan for exposed Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, or SupportCenter Plus instances.
2. Fingerprint the product and build to determine whether it is older than ServiceDesk Plus 11306, ServiceDesk Plus MSP 10530, or SupportCenter Plus 11014.
3. Send crafted unauthenticated requests to /RestAPI paths associated with the ImportTechnicians Struts action.
4. Achieve remote command execution under the privileges of the ManageEngine application service.
5. Deploy a web shell, script, or executable payload to maintain access.
6. Run host and application discovery commands and enumerate local files, users, services, tickets, attachments, and configuration data.
7. Collect credentials, API keys, database connection details, or integration secrets available to the application.
8. Use the compromised server for lateral movement, data exfiltration, or further internal reconnaissance.
9. Clear or tamper with application, web, and operating system logs to hide evidence of compromise.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF logs, ManageEngine application logs, and operating system telemetry for evidence of unauthenticated requests to /RestAPI paths, especially requests referencing ImportTechnicians. Investigate POST requests, unusual user agents, non-browser clients, unexpected source countries, high error rates followed by successful responses, and requests that precede file creation or process execution. On the host, examine ManageEngine installation directories for newly created or modified JSP, WAR, EXE, DLL, BAT, CMD, PS1, SH, JAR, ZIP, or archive files, especially under web application, work, temp, upload, and custom directories. Review process creation logs for command interpreters, scripting engines, archive tools, download utilities, or network tools spawned by the ManageEngine Java/Tomcat process. Check for outbound connections from the application server to unfamiliar IP addresses shortly after suspicious REST API requests. Correlate application logs with Windows Event Logs, Sysmon, EDR telemetry, Linux audit logs where applicable, scheduled tasks or cron entries, new local users, service creation events, and credential dumping or reconnaissance commands. Because this vulnerability has been exploited in the wild, absence of a single indicator is not sufficient; use timeline analysis around suspicious /RestAPI activity and patch dates.

• /RestAPI/ImportTechnicians
• ImportTechnicians
• /RestAPI/
• POST /RestAPI
• GET /RestAPI
• ImportTechnicians.do
• java.exe spawning cmd.exe
• java.exe spawning powershell.exe
• java.exe spawning /bin/sh
• java.exe spawning bash
• ManageEngine ServiceDesk Plus
• ManageEngine ServiceDesk Plus MSP
• ManageEngine SupportCenter Plus
• .jsp created under ManageEngine
• .war created under ManageEngine
• .exe created under ManageEngine
• C:\ManageEngine\ServiceDesk\
• C:\ManageEngine\ServiceDeskPlus-MSP\
• C:\ManageEngine\SupportCenter\
• /opt/ManageEngine/ServiceDesk/
• /opt/ManageEngine/SupportCenter/

What your security team should do

• Immediately identify all internet-facing and internally exposed ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus instances.
• Upgrade to ServiceDesk Plus 11306 or later, ServiceDesk Plus MSP 10530 or later, or SupportCenter Plus 11014 or later as applicable.
• Treat unpatched or historically exposed systems as potentially compromised due to KEV listing, active in-the-wild exploitation, and high EPSS likelihood.
• Perform a retrospective compromise assessment covering web access logs, application logs, operating system event logs, process creation telemetry, and file system changes around the first known exposure window through the patch date.
• Search specifically for unauthenticated requests to /RestAPI and ImportTechnicians-related paths, unexpected child processes spawned by the ManageEngine service, and recently created JSP, WAR, EXE, BAT, PowerShell, shell script, or archive files under the application directory.
• Temporarily isolate or restrict access to any vulnerable instance until patched and assessed.
• Rotate application administrator passwords, database credentials, API tokens, LDAP or directory integration credentials, mail service credentials, and any secrets stored in application configuration if compromise is suspected.
• Add WAF, reverse proxy, or SIEM detections for exploitation attempts against /RestAPI/ImportTechnicians and related anomalous unauthenticated REST API activity.
• Ensure the ManageEngine service runs with the least privilege necessary and is not using a highly privileged domain or local administrator account.
• Preserve logs and forensic images before rebuilding or cleaning systems where exploitation indicators are found.