CVE-2021-28960: ManageEngine Desktop Central

Critical severity, CVSS 9.8. EPSS: 2% chance of exploitation in the next 30 days.

Zoho ManageEngine Desktop Central before build 10.0.683 allows unauthenticated command injection due to improper handling of an input command in on-demand operations.

Affected products

• ManageEngine Desktop Central: before 10.0.683 (fixed in 10.0.683)

Published 2021-09-21. Last modified 2026-06-17.