CVE-2021-37415: Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 99.8% chance of exploitation in the next 30 days.

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

Affected products

• Zohocorp ManageEngine ServiceDesk Plus: version 11.0 only; version 11.1 only; version 11.2 only; version 11.3 only

Published 2021-09-01. Last modified 2026-06-17.