Zoho ManageEngine Desktop Central File Upload Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2020-10189 · Published 06/03/2020 · updated 17/06/2026

Zoho ManageEngine Desktop Central File Upload Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
manageengine desktop central zohocorp	`< 10.0.479`	`10.0.479`

Description

Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.

References

packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html · Exploit
cwe.mitre.org/data/definitions/502.html · Third Party Advisory
srcincite.io/advisories/src-2020-0011 · Exploit
srcincite.io/pocs/src-2020-0011.py.txt · Exploit
manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html · Vendor Advisory
zdnet.com/article/zoho-zero-day-published-on-twitter · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-10189

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free