CVE-2021-44515

What it actually does

The vulnerability is an unauthenticated network-accessible authentication bypass in Zoho ManageEngine Desktop Central/Desktop Central MSP that can lead to remote code execution on the management server. A remote attacker does not need valid credentials or user interaction; if the management interface is reachable, crafted requests can bypass access controls and cause attacker-controlled code or commands to execute with the privileges of the Desktop Central server process. Because Desktop Central is an endpoint management platform, compromise of the server can also provide a path to managed endpoint control, credential theft, software deployment abuse, and broader lateral movement. The supplied package metadata references tildearrow/furnace fixed at commit 0eb02422d5161767e9983bdaa5c429762d3477ce, which does not align with the Zoho Desktop Central description; treat that as an SBOM/data-quality item to validate separately.

Why it matters to the business

Successful exploitation can turn an endpoint management server into an attacker-controlled command platform. This may disrupt patching, software deployment, endpoint administration, and incident response operations, while also giving an intruder a privileged route into large numbers of managed systems. The vulnerability has a critical CVSS score, an extremely high EPSS likelihood of exploitation, and is listed in CISA KEV with a remediation deadline of 2021-12-24; it was actively exploited in the wild shortly after publication and remains high-priority for any exposed or unpatched instance even years later. Although the provided KEV ransomware flag is false, compromise of endpoint management infrastructure can still enable ransomware-like outcomes if attackers use it to distribute payloads or disable defenses.

How an attack unfolds

An attacker first identifies an internet-facing or otherwise reachable Desktop Central/Desktop Central MSP server. They send specially crafted HTTP requests to vulnerable server endpoints that improperly allow access without a valid authenticated session. After bypassing authentication, the attacker abuses exposed functionality to execute commands or place executable server-side content such as a web shell. The code then runs under the Desktop Central service account, allowing the attacker to issue operating-system commands, enumerate configuration and credentials, stage additional tooling, and pivot into managed endpoints or adjacent infrastructure. In observed exploitation campaigns, attackers have targeted exposed management servers because they often have elevated trust and connectivity across enterprise endpoint fleets.

How to fix it

Upgrade affected Zoho ManageEngine Desktop Central/Desktop Central MSP installations immediately. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18 or later. For Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3 or later. For MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18 or later. For MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3 or later. If the supplied SBOM entry for tildearrow/furnace is relevant to a separate exposure, update that Git dependency to commit 0eb02422d5161767e9983bdaa5c429762d3477ce or a later trusted revision; however, do not treat that as a substitute for patching Zoho Desktop Central. If immediate upgrade is not possible, remove public internet exposure, restrict access to trusted administrative networks or VPN, enforce firewall allowlists, isolate the server from unnecessary outbound connectivity, rotate credentials that may be stored or used by the platform, and closely monitor for compromise. Because this flaw has been exploited in the wild, patching should be paired with compromise assessment rather than treated as a routine update.

How to confirm the fix worked

Confirm the installed Desktop Central/Desktop Central MSP build number from the application console, service metadata, or installation records and verify it is at or above the applicable fixed version: 10.1.2127.18 for the older branch or 10.1.2137.3 for the later branch. Validate that the management interface is not reachable from untrusted networks unless explicitly required and protected by strong access controls. Re-run authenticated vulnerability scans or vendor-supported version checks after the upgrade. Review web, application, and EDR telemetry from before the patch date through the current date for signs of exploitation, because an attacker may retain access after the software is updated. If suspicious artifacts are found, rebuild the server from known-good media where feasible, rotate platform credentials, and validate managed endpoint integrity.

Typical attack path

1. Scan for exposed Zoho ManageEngine Desktop Central or Desktop Central MSP services.
2. Fingerprint the application and version to identify vulnerable builds.
3. Send crafted unauthenticated HTTP requests that bypass normal login enforcement.
4. Abuse the bypassed functionality to write or execute attacker-controlled code on the server.
5. Establish persistence, commonly through a web shell, scheduled task, service, or additional remote access tool.
6. Run discovery commands to enumerate users, domain relationships, managed endpoints, credentials, and security tools.
7. Use the management server’s privileges and network reachability to move laterally or deploy payloads to additional systems.
8. Exfiltrate data, maintain access, or disrupt endpoint-management operations.

How to detect it

Review evidence sources that can show both initial exploitation and post-exploitation activity: reverse proxy logs, load balancer logs, web access logs, Desktop Central application logs, Tomcat logs, EDR process telemetry, command-line logging, file-creation events, scheduled-task/service creation events, authentication logs, and outbound network flow records. Focus on unauthenticated or anomalous HTTP requests to Desktop Central endpoints, especially requests returning success from unfamiliar IP addresses before any valid login. Look for newly created or modified executable server-side files under the Desktop Central web application directories, particularly JSP, WAR, class, script, or archive files. Hunt for the Desktop Central Java/Tomcat service spawning operating-system shells or administrative tools such as cmd.exe, powershell.exe, certutil.exe, bitsadmin.exe, wmic.exe, bash, sh, curl, or wget. Investigate outbound connections from the management server to unusual external IPs, newly observed domains, VPS providers, paste sites, or file-sharing services. Also review platform audit logs for unexpected software deployment jobs, script execution, administrator account creation, remote-control sessions, credential changes, and configuration changes. Because exploitation was observed in the wild in December 2021 and the issue is KEV-listed, searches should include historical logs where available and not only current detections.

• CVE-2021-44515
• ManageEngine Desktop Central
• ManageEngine DesktopCentral
• DesktopCentral_Server
• Desktop Central MSP
• ManageEngine\\DesktopCentral_Server\\webapps\\DesktopCentral
• ManageEngine/DesktopCentral_Server/webapps/DesktopCentral
• ManageEngine\\DesktopCentral_Server\\logs
• ManageEngine/DesktopCentral_Server/logs
• localhost_access_log
• serverout
• wrapper.log
• java.exe -> cmd.exe
• java.exe -> powershell.exe
• java.exe -> certutil.exe
• java.exe -> bitsadmin.exe
• java.exe -> wmic.exe
• java.exe -> rundll32.exe
• java.exe -> mshta.exe
• java.exe -> regsvr32.exe
• java.exe -> schtasks.exe
• java.exe -> net.exe
• java.exe -> nltest.exe
• java.exe -> whoami.exe
• java.exe -> ipconfig.exe
• java.exe -> curl.exe
• java.exe -> wget.exe
• tomcat.exe -> cmd.exe
• tomcat.exe -> powershell.exe
• *.jsp created under DesktopCentral webapps
• *.war created under DesktopCentral webapps
• *.class created under DesktopCentral webapps

What your security team should do

• Treat any vulnerable or previously internet-exposed Desktop Central/Desktop Central MSP server as a potential compromise and perform incident response before returning it to full trust.
• Upgrade immediately to the applicable fixed Zoho build: 10.1.2127.18 or 10.1.2137.3 or later, depending on branch and edition.
• Remove public exposure of the management interface; place it behind VPN, administrative jump hosts, firewall allowlists, and centralized logging.
• Collect and preserve application logs, web access logs, endpoint telemetry, file-system timelines, and memory/process evidence before cleanup if exploitation is suspected.
• Hunt for web shells, new JSP/WAR files, suspicious child processes spawned by Java/Tomcat, unexpected scheduled tasks, and unusual outbound connections from the management server.
• Rotate credentials, API tokens, service accounts, deployment credentials, certificates, and secrets accessible to the endpoint-management platform.
• Audit software deployment jobs, scripts, packages, remote-control activity, and administrator accounts created or modified around the suspected exploitation window.
• Validate SBOM and vulnerability-management mappings because the provided affected product metadata does not match the Zoho vulnerability description.
• Add detection rules for suspicious ManageEngine server behavior and alert on management servers spawning command shells, script interpreters, download utilities, or network scanners.
• Prioritize this vulnerability above routine patching because it is KEV-listed, actively exploited, unauthenticated, remotely exploitable, and has very high exploitation probability.