CVE-2021-37415: Zoho ManageEngine ServiceDesk Plus authentication bypass via REST API

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing and an EPSS probability above 0.99 make this an actively exploited, remotely reachable authentication bypass requiring immediate remediation.

What it is

Zoho ManageEngine ServiceDesk Plus before build 11302 contains an authentication bypass (CWE-306) that lets a small number of REST-API URLs be reached without authentication. Because the affected endpoints are exposed over the network with no credentials required, the flaw is trivially reachable and carries a critical CVSS score of 9.8.

Impact

An unauthenticated attacker gains access to functionality normally reserved for authenticated users, with the CVSS vector indicating high confidentiality, integrity and availability impact. The exact data or actions exposed by the bypassed URLs are not detailed in the record.

Attack surface

Reached over the network via the affected REST-API URLs; the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication and no user interaction are needed.

Exploitation

The vulnerability is listed in CISA KEV (added 2021-12-01, due 2021-12-15) and has an EPSS 30-day probability of 0.99825 (percentile 0.99959), indicating active exploitation and near-certain attack likelihood. CISA KEV does not flag it as used in known ransomware campaigns.

What to do

• Upgrade ManageEngine ServiceDesk Plus to build 11302 or later per the vendor release notes.
• If immediate patching is not possible, restrict network access to the ServiceDesk Plus REST API to trusted hosts only.
• Place the instance behind a reverse proxy or WAF and block unauthenticated requests to the affected API paths.
• Review and rotate credentials or tokens that may have been exposed through the bypassed endpoints.
• Monitor vendor and CISA guidance for any further updates tied to this CVE.

Detection

• Search web and proxy logs for requests to ServiceDesk Plus REST API paths that succeed without a session or authentication header.
• Alert on anomalous or unexpected source IPs accessing the ServiceDesk Plus API, especially outside normal admin networks.
• Correlate ServiceDesk Plus application logs for API calls made without prior login events from the same source.
• Hunt for post-exploitation activity such as new admin accounts, configuration changes or data exports following unauthenticated API access.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.