CVE-2021-31159: Zohocorp ManageEngine ServiceDesk Plus Msp

Medium severity, CVSS 5.3. EPSS: 17.8% chance of exploitation in the next 30 days.

Zoho ManageEngine ServiceDesk Plus MSP before 10519 is vulnerable to a User Enumeration bug due to improper error-message generation in the Forgot Password functionality, aka SDPMSP-15732.

Affected products

• Zohocorp ManageEngine ServiceDesk Plus Msp: from 8.0, up to and including 9.4; version 10.5 only

Published 2021-06-16. Last modified 2026-06-17.