Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability

MEDIUM 6.5EXPLOITED (CISA KEV)CVE-2019-8394 · Published 17/02/2019 · updated 17/06/2026

Zoho ManageEngine ServiceDesk Plus (SDP) File Upload Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
manageengine servicedesk plus zohocorp	`= 10.0.0< 10.0.0`	`10.0.0`

Description

Zoho ManageEngine ServiceDesk Plus (SDP) before 10.0 build 10012 allows remote attackers to upload arbitrary files via login page customization.

References

securityfocus.com/bid/107129 · Third Party Advisory
exploit-db.com/exploits/46413 · Exploit
manageengine.com/products/service-desk/readme.html · Release Notes
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2019-8394

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free