CVE-2019-8395: Zohocorp ManageEngine ServiceDesk Plus

Critical severity, CVSS 9.8. EPSS: 7.1% chance of exploitation in the next 30 days.

An Insecure Direct Object Reference (IDOR) vulnerability exists in Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10007 via an attachment to a request.

Affected products

• Zohocorp ManageEngine ServiceDesk Plus: before 10.0 (fixed in 10.0)

Published 2019-02-17. Last modified 2026-06-17.