CVE-2020-10189: Zoho ManageEngine Desktop Central File Upload Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.9% chance of exploitation in the next 30 days.

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

Affected products

• Zohocorp ManageEngine Desktop Central: before 10.0.479 (fixed in 10.0.479)

Published 2020-03-06. Last modified 2026-06-17.