CVE-2021-37415

9.8
CRITICALCVSS v3.1 Base Score
99.83%
HIGH RiskEPSS (100th percentile)
KEV
CWE-306

Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication.

Published: 9/1/2021
Modified: 6/17/2026
Back to CVE Lookup

ACTIVELY EXPLOITED IN THE WILD

This vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Vulnerability Name:

Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability

Vendor / Product:

Zoho ManageEngine ServiceDesk Plus (SDP)

Required Action:

Apply updates per vendor instructions.

Due Date: 12/15/2021(OVERDUE)
Added to KEV:

12/1/2021

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2021-37415

View CISA KEV Catalog

Vulnerability Summary

CVSS v3 Score

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2 Score

7.5

AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Score (Exploitation Probability)

99.83%HIGH Exploitation Risk
100th percentile

This vulnerability has a 99.83% probability of being exploited in the next 30 days, ranking higher than 100% of all scored CVEs.

CWE Classification

CWE-306

Learn More

CVSS Calculator

View this score breakdown or calculate a custom score

Understanding CVSS Scoring

Learn how severity scores are calculated and what they mean

CVE Prioritization Guide

Best practices for deciding which vulnerabilities to address first

What is a CVE?

Essential guide to Common Vulnerabilities and Exposures

CVE vs CWE Explained

Understand how CVEs relate to underlying weakness types

Advertisement