CVE-2021-37415 Zoho ManageEngine ServiceDesk Authentication Bypass

Exploited in the wild Critical 9.8 Published 1 Sep 2021 Updated 21 Oct 2025

Attackers can access specific REST-API endpoints without authentication, potentially exposing sensitive data in Zoho ManageEngine ServiceDesk Plus.

Exploited in the wild: Since 1 Dec 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-37415?

CVE-2021-37415 is a critical authentication bypass vulnerability in Zohocorp Manageengine Servicedesk Plus, published on 1 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

Weakness: CWE-306

Which versions are affected by CVE-2021-37415?

It affects 1 product.

Products include Zohocorp Manageengine Servicedesk Plus.

How do I fix CVE-2021-37415?

No fix has been published for CVE-2021-37415 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 15 Dec 2021.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-37415 being exploited?

Yes. Attackers have exploited CVE-2021-37415 in the wild since at least 1 Dec 2021.

Public exploit code: 1 Nuclei template.

All Zohocorp Manageengine Servicedesk Plus vulnerabilities

Sources

Also known as GHSA-wf6j-6x58-69fg.