CVE-2015-8249: ManageEngine Desktop Central FileUploadServlet unrestricted file upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with public exploit code and very high EPSS probability makes this an urgent patching target.

What it is

The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 fails to restrict uploaded files, allowing arbitrary file upload through the ConnectionId parameter. Because the uploaded file can then be executed, this is a direct path to remote code execution on the server. The flaw is remotely reachable and requires no authentication or user interaction.

Impact

An unauthenticated remote attacker can upload and execute arbitrary files, gaining code execution in the context of the Desktop Central service, which typically runs with high privileges on the host. This can lead to full compromise of the management server and any endpoints it controls.

Attack surface

Reached over the network via HTTP requests to the FileUploadServlet, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

Public exploit code exists (Exploit-DB 38982, PacketStorm, and a Rapid7 Metasploit module), and EPSS is 0.736 with a 0.994 percentile, indicating high predicted exploitation activity. The CVE is not listed in CISA KEV, and no ransomware groups are documented as using it.

What to do

• Upgrade ManageEngine Desktop Central 9 to build 91093 or later, which contains the fix.
• If immediate patching is not possible, restrict network access to the Desktop Central web interface to trusted management networks only.
• Block or filter requests to FileUploadServlet and the ConnectionId parameter at the web server or WAF.
• Run the Desktop Central service under a least-privileged account to limit the impact of code execution.
• Monitor for unexpected files written to web-accessible directories and remove any found.

Detection

• Inspect HTTP logs for POST requests to FileUploadServlet with a ConnectionId parameter, especially from untrusted sources.
• Monitor the Desktop Central install directory and web-accessible paths for newly created executable or script files.
• Alert on child processes spawned by the Desktop Central service, such as cmd.exe, powershell.exe, or wscript.exe.
• Use the Rapid7 Metasploit module signature and Exploit-DB 38982 request patterns to build IDS/IPS rules.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.