CVE-2020-10189: Zoho ManageEngine Desktop Central deserialization RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable RCE with a CVSS of 9.8, KEV listing and near-certain EPSS probability, plus public exploit code.

What it is

Zoho ManageEngine Desktop Central before 10.0.474 deserializes untrusted data in the getChartImage method of the FileStorage class, reachable through the CewolfServlet and MDMLogUploaderServlet servlets. This allows unauthenticated remote code execution on the server. It matters because Desktop Central is an agent-management platform, so compromise gives a foothold over managed endpoints.

Impact

An unauthenticated attacker can execute arbitrary code with the privileges of the Desktop Central service, potentially taking control of the server and the endpoints it manages.

Attack surface

Reachable over the network through the exposed CewolfServlet and MDMLogUploaderServlet HTTP endpoints. The CVSS vector shows no privileges or user interaction required, so exploitation is unauthenticated and needs no victim action.

Exploitation

Listed in CISA KEV since 2021-11-03 with a required action to apply vendor updates, and EPSS 30-day probability is 0.99941 (99.97th percentile). Multiple references are tagged Exploit, including public PoC code, so exploitation is mature and widely available.

What to do

• Upgrade Desktop Central to 10.0.474 or later per the vendor advisory.
• If immediate patching is not possible, restrict network access to the Desktop Central web interface and the CewolfServlet and MDMLogUploaderServlet endpoints to trusted management networks only.
• Place the server behind a reverse proxy or WAF that blocks deserialization payloads to those servlets.
• Rotate credentials and secrets stored on or used by the Desktop Central server if compromise is suspected.
• Monitor vendor advisories and CISA KEV for updated guidance.

Detection

• Inspect HTTP requests to CewolfServlet and MDMLogUploaderServlet for serialized Java object payloads or unusual content types.
• Alert on unexpected child processes spawned by the Desktop Central Java process, such as cmd.exe, powershell.exe or /bin/sh.
• Review Desktop Central and web server logs for anomalous POST requests to the affected servlet paths.
• Hunt for outbound connections from the Desktop Central host to unfamiliar external addresses following servlet requests.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.