Remote Code Execution in Zoho ManageEngine ServiceDesk Plus (CVE‑2021‑44077) Threatens IT Service‑Management Platforms
What It Is — Zoho ManageEngine ServiceDesk Plus (SDP) and SupportCenter Plus contain an unauthenticated remote‑code‑execution flaw (CVE‑2021‑44077). An attacker can send a crafted HTTP request that triggers arbitrary OS‑level commands on the server.
Exploitability — The vulnerability is rated CVSS 3.1 9.8 (Critical). No public exploit code has been released, but the attack surface is wide because it requires no authentication.
Affected Products — Zoho ManageEngine ServiceDesk Plus < v11306, ServiceDesk Plus MSP < v10530, and SupportCenter Plus < v11014.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability‑management controls and evidence that patches are applied promptly.
- A missing patch creates a gap in the control objective “Maintain an up‑to‑date, securely configured environment,” which maps to dozens of framework requirements (e.g., NIST CSF PR.IP‑12, ISO 27001 A.12.6).
- Enterprise buyers increasingly request audit‑ready proof that such high‑severity flaws are tracked, mitigated, and documented in a centralized Trust Center.
Recommended Actions
- Inventory all Zoho ManageEngine instances and verify the exact version.
- Apply the vendor‑provided patches (v11306, v10530, v11014 or later) immediately.
- Record the patch‑application event in your control‑evidence repository to satisfy the vulnerability‑management control objective.
- Enable logging of management‑console activity and monitor for anomalous requests.
- Map this remediation to your framework of record and retain evidence for audit readiness.
Source: CISA KEV – CVE‑2021‑44077