{"id":"CVE-2020-10189","published":"2020-03-06T17:15:12Z","modified":"2026-06-17T02:47:27Z","title":"Zoho ManageEngine Desktop Central File Upload Vulnerability","vendor":"Zoho","product":"ManageEngine","tier":"core","eol":null,"description":{"text":"Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.","provenance":"source","from":"NVD"},"summary":{"text":"Zoho ManageEngine Desktop Central, before version 10.0.474, contains a deserialization of untrusted data flaw in the getChartImage method of the FileStorage class, related to the CewolfServlet and MDMLogUploaderServlet servlets. An attacker with network access can exploit it without authentication or user interaction to achieve remote code execution.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:03:24Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99941,"percentile":0.99972,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-10189","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-03-25","exploitedFirstSeen":"2020-03-25","ransomware":false,"evidence":[{"url":"https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign-using-multiple-exploits","date":"2020-03-25"},{"url":"https://www.justice.gov/opa/pr/seven-international-cyber-defendants-including-apt41-actors-charged-connection-computer","date":"2020-09-16"},{"url":"https://www.bleepingcomputer.com/news/security/us-charges-chinese-winnti-hackers-for-attacking-100-plus-companies/","date":"2020-09-17"},{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a","date":"2020-10-20"},{"url":"https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-275a","date":"2020-10-20"},{"url":"https://github.com/blackorbird/APT_REPORT/raw/master/summary/2021/The%20CrowdStrike%202021%20Global%20Threat%20Report.pdf","date":"2021-04-02"},{"url":"https://services.google.com/fh/files/misc/rpt-mtrends-2021-en.pdf","date":"2021-04-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2022GTR.pdf","date":"2022-02-15"}],"evidenceTotal":504,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"references":[{"url":"http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://cwe.mitre.org/data/definitions/502.html","tags":["Third Party Advisory"]},{"url":"https://srcincite.io/advisories/src-2020-0011/","tags":["Exploit","Third Party Advisory"]},{"url":"https://srcincite.io/pocs/src-2020-0011.py.txt","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html","tags":["Vendor Advisory"]},{"url":"https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/","tags":["Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://cwe.mitre.org/data/definitions/502.html","tags":["Third Party Advisory"]},{"url":"https://srcincite.io/advisories/src-2020-0011/","tags":["Exploit","Third Party Advisory"]},{"url":"https://srcincite.io/pocs/src-2020-0011.py.txt","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html","tags":["Vendor Advisory"]},{"url":"https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/","tags":["Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Deserialization yields arbitrary code execution on server","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allows remote code execution because of deserialization of untrusted data","start":50,"end":123}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Unauthenticated remote deserialization exploit against public-facing servlet","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allows remote code execution because of deserialization of untrusted data","start":50,"end":123}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-f144807c3c05fbc98a1a","title":"Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","publisher":"microsoft.com","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","date":"2022-05-09","mentions":[{"quote":"Zoho ManageEngine systems affected by CVE-2020-10189","start":62540,"end":62592}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-2650","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2650","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":48224,"url":"https://www.exploit-db.com/exploits/48224","title":"ManageEngine Desktop Central - Java Deserialization (Metasploit)","type":"remote","platform":"multiple","date":"2020-03-17","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2020-03-17"},"pocGithub":{"count":1,"skipped":0,"earliest":"2020-11-12","earliestUrl":"https://github.com/zavke/CVE-2020-10189-ManageEngine","repos":[{"name":"zavke/CVE-2020-10189-ManageEngine","url":"https://github.com/zavke/CVE-2020-10189-ManageEngine","stars":3,"created":"2020-11-12"}]},"metasploit":[{"name":"ManageEngine Desktop Central Java Deserialization","module":"exploit/windows/http/desktopcentral_deserialization","type":"exploit","disclosureDate":"2020-03-05","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_deserialization.rb"}],"nuclei":[{"id":"CVE-2020-10189","name":"ManageEngine Desktop Central Java Deserialization","severity":"critical","path":"http/cves/2020/CVE-2020-10189.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-10189.yaml"}],"first":{"date":"2020-03-05","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_deserialization.rb"},"provenance":"source"},"detections":{"cveRules":[{"title":"Exploited CVE-2020-10189 Zoho ManageEngine","id":"846b866e-2a57-46ee-8e16-85fa92759be7","level":"high","status":"test","path":"rules-emerging-threats/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-10189/proc_creation_win_exploit_cve_2020_10189.yml","techniques":["T1190","T1059.001","T1059.003"]}]},"exploitRefs":["http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html","https://srcincite.io/advisories/src-2020-0011/","https://srcincite.io/pocs/src-2020-0011.py.txt"],"flow":[{"stage":"related","techniques":["T1190","T1059"],"provenance":"source"}],"timeline":[{"date":"2020-03-05","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2020-03-17, PoC-in-GitHub 2020-11-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/desktopcentral_deserialization.rb","provenance":"source"},{"date":"2020-03-06","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10189","provenance":"source"},{"date":"2020-03-25","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.mandiant.com/resources/blog/apt41-initiates-global-intrusion-campaign-using-multiple-exploits","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-2650","provenance":"source"},{"date":"2022-05-09","kind":"report","label":"Named in microsoft.com: Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/","provenance":"machine"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":607},"priority":{"score":73.7,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2411 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}