CVE-2021-44077 KEVPublic exploit Critical · 9.8 EPSS 93.3%
Zoho ManageEngine ServiceDesk Plus Remote Code Execution Vulnerability
Zoho · ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus
Summary
Zoho ManageEngine ServiceDesk Plus, ServiceDesk Plus MSP, and SupportCenter Plus contain a missing-authentication flaw in the servlet handling /RestAPI URLs and the ImportTechnicians entry in the Struts configuration. An unauthenticated attacker with network access to the affected application can reach the vulnerable functionality and execute arbitrary code, with no user interaction or prior credentials required.
Official description · NVD
Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet, and ImportTechnicians in the Struts configuration.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
69.8 / 100
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 8/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.How attackers get in
What they do
What can follow
- Windows Management InstrumentationT1047 · Windows Management Instrumentation
- Create a new account to keep accessT1136 · Create Account
- Hide malicious codeT1027 · Obfuscated Files or Information
- Delete files to cover tracksT1070.004 · File Deletion
- Deobfuscate/Decode Files or InformationT1140 · Deobfuscate/Decode Files or Information
- System Binary Proxy ExecutionT1218 · System Binary Proxy Execution
- Dump stored passwords and hashesT1003 · OS Credential Dumping
- Copy the Active Directory databaseT1003.003 · NTDS
- List domain accountsT1087.002 · Domain Account
- Archive via UtilityT1560.001 · Archive via Utility
- Symmetric CryptographyT1573.001 · Symmetric Cryptography
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 days after disclosure. Public exploit code (Metasploit) was available 2 months before disclosure.
- Public exploit codeMetasploit2 mo before
- Disclosedday 0
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
13 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 13Initial AccessTA0001
Exploit Public-Facing Application T1190 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · how it is exploited
CVE-2021-44077 is an unauthenticated remote code execution vulnerability. The following post-exploitation activity has been observed by adversaries: writing webshells to disk for persistence, obfuscating and deobfuscating/decoding files or information, dumping user credentials, only using signed windows binaries for follow-on actions, adding/deleting user accounts as needed, exfiltrating the active directory database, using windows management instrumentation for remote execution, deleting files to remove indicators from the host, discovering domain accounts, collecting and archiving files for exfiltration, and using symmetric encryption for command and control.
ExecutionTA0002
Windows Management Instrumentation T1047 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
PersistenceTA0003
Create Account T1136 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
Web Shell T1505.003 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · primary impact
Stealth
Obfuscated Files or Information T1027 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
File Deletion T1070.004 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
Deobfuscate/Decode Files or Information T1140 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
System Binary Proxy Execution T1218 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
Credential AccessTA0006
OS Credential Dumping T1003 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
NTDS T1003.003 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
DiscoveryTA0007
Domain Account T1087.002 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
CollectionTA0009
Archive via Utility T1560.001 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
Command and ControlTA0011
Symmetric Cryptography T1573.001 Medium Confidence (technique links)How sure Patchfirst is that an ATT&CK technique applies to this CVE. High and medium links are shown by default; low ones come from early or generic mappings, text matching, or contradict the CVE’s details.
MITRE CTID mapping of the KEV entry · follow-on activity
Detection
1 rule for this CVE · 624 general rules for its techniquesRules for this CVE
1Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2021-44077 directly.General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
Exploit Public-Facing ApplicationT1190149 general rules
- Arcadyan Router Exploitationscriticaltest
- Citrix ADS Exploitation CVE-2020-8193 CVE-2020-8195criticaltest
- Citrix Netscaler Attack CVE-2019-19781criticaltest
- Confluence Exploitation CVE-2019-3398criticaltest
- CVE-2010-5278 Exploitation Attemptcriticaltest
- CVE-2020-0688 Exchange Exploitation via Web Logcriticaltest
- CVE-2020-10148 SolarWinds Orion API Auth Bypasscriticaltest
- CVE-2020-5902 F5 BIG-IP Exploitation Attemptcriticaltest
Web ShellT1505.00335 general rules
- Certificate Request Export to Exchange Webservercriticaltest
- CVE-2021-40539 Zoho ManageEngine ADSelfService Plus Exploitcriticaltest
- Mailbox Export to Exchange Webservercriticaltest
- Oracle WebLogic Exploitcriticaltest
- Solarwinds SUPERNOVA Webshell Accesscriticaltest
- Webshell Remote Command Executioncriticaltest
- WordPress Wp2shell Webshell Plugin Accesscriticalexperimental
- Antivirus - Web Shell Detection Signaturehightest
Windows Management InstrumentationT104752 general rules
- Potential Maze Ransomware Activitycriticaltest
- UNC2452 PowerShell Patterncriticaltest
- Wmiexec Default Output Filecriticaltest
- Wmiprvse Wbemcomn DLL Hijack - Filecriticaltest
- HackTool - CrackMapExec Execution Patternshighstable
- HackTool - Potential Impacket Lateral Movement Activityhighstable
- Blue Mockingbirdhightest
- Blue Mockingbird - Registryhightest
Create AccountT11363 general rules
Obfuscated Files or InformationT102795 general rules
- Turla Group Commands May 2020criticaltest
- Potential Emotet Activityhighstable
- Base64 Encoded PowerShell Command Detectedhightest
- File Decoded From Base64/Hex Via Certutil.EXEhightest
- File In Suspicious Location Encoded To Base64 Via Certutil.EXEhightest
- Invoke-Obfuscation CLIP+ Launcherhightest
- Invoke-Obfuscation CLIP+ Launcher - PowerShellhightest
- Invoke-Obfuscation CLIP+ Launcher - PowerShell Modulehightest
File DeletionT1070.00415 general rules
- Prefetch File Deletedhightest
- Suspicious Ping/Del Command Combinationhightest
- ADS Zone.Identifier Deleted By Uncommon Applicationmediumtest
- Backup Catalog Deletedmediumtest
- Cisco File Deletionmediumtest
- File Deleted Via Sysinternals SDeletemediumtest
- Greedy File Deletion Using Delmediumtest
- Potential Secure Deletion with SDeletemediumtest
Deobfuscate/Decode Files or InformationT114018 general rules
- Base64 Encoded PowerShell Command Detectedhightest
- MSHTA Execution with Suspicious File Extensionshightest
- Ping Hex IPhightest
- Potential Base64 Decoded From Imageshightest
- Potential BlackByte Ransomware Activityhightest
- PowerShell Base64 Encoded FromBase64String Cmdlethightest
- Suspicious Inbox Manipulation Ruleshightest
- UNC4841 - Download Compressed Files From Temp.sh Using Wgethightest
System Binary Proxy ExecutionT1218158 general rules
- Arbitrary File Download Via IMEWDBLD.EXEhightest
- Curl Download And Execute Combinationhightest
- Devtoolslauncher.exe Executes Specified Binaryhightest
- Execute Pcwrun.EXE To Leverage Follinahightest
- Execution DLL of Choice Using WAB.EXEhightest
- Execution via stordiag.exehightest
- Execution via WorkFolders.exehightest
- File Download Via Windows Defender MpCmpRun.EXEhightest
OS Credential DumpingT100337 general rules
- Antivirus - Password Dumper Signaturecriticalstable
- HackTool - Rubeus Executioncriticalstable
- Hacktool Execution - Imphashcriticaltest
- Potential Credential Dumping Via LSASS Process Clonecriticaltest
- WCE wceaux.dll Accesscriticaltest
- HackTool - Potential Remote Credential Dumping Activity Via CrackMapExec Or Impacket-Secretsdumphightest
- HackTool - Rubeus Execution - ScriptBlockhightest
- Hacktool Execution - PE Metadatahightest
NTDST1003.00324 general rules
- Potential Russian APT Credential Theft Activitycriticalstable
- VolumeShadowCopy Symlink Creation Via Mklinkhighstable
- Copying Sensitive Files with Credential Datahightest
- Create Volume Shadow Copy with Powershellhightest
- Cred Dump Tools Dropped Fileshightest
- NTDS Exfiltration Filename Patternshightest
- NTDS.DIT Creation By Uncommon Parent Processhightest
- NTDS.DIT Creation By Uncommon Processhightest
Domain AccountT1087.00221 general rules
- AD Privileged Users or Groups Reconnaissancehightest
- BloodHound Collection Fileshightest
- HackTool - Bloodhound/Sharphound Executionhightest
- Malicious PowerShell Commandlets - PoshModulehightest
- Malicious PowerShell Commandlets - ProcessCreationhightest
- Malicious PowerShell Commandlets - ScriptBlockhightest
- PUA - AdFind Suspicious Executionhightest
- PUA - Suspicious ActiveDirectory Enumeration Via AdFind.EXEhightest
Archive via UtilityT1560.00117 general rules
- APT31 Judgement Panda Activitycriticaltest
- Rar Usage with Password and Compression Levelhightest
- Suspicious Manipulation Of Default Accounts Via Net.EXEhightest
- LiteLLM / TeamPCP Supply Chain Attack Indicatorshighexperimental
- 7Zip Compressing Dump Filesmediumtest
- Compress Data and Lock With Password for Exfiltration With 7-ZIPmediumtest
- Compress Data and Lock With Password for Exfiltration With WINZIPmediumtest
- Disk Image Mounting Via Hdiutil - MacOSmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX