Actively exploited · CISA KEV · NVD published 2020-03-06
Actively exploitedCVE-2020-10189
Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.
- First PoC
- 2102 days →Metasploit
- 304 days →First cited attacker
Signals
- Exploited in the wild
- Yesadded 2021-11-03 · due 2022-05-03. An observation, not a forecast.
- EPSS · 30-day forecast
- 99.9%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · CRITICAL
- 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
3 known · links onlyMetasploit1
This module exploits a Java deserialization vulnerability in the getChartImage() method from the FileStorage class within ManageEngine Desktop Central versions < 10.0.474. Tested against 10.0.465 x64. Quoting the vendor's advisory on fixed versions: "The short-term fix for the arbitrary file upload vulnerability was released in build 10.0.474 on January 20, 2020. In continuation of that, the complete fix for the remote code execution
ruby · seen 2026-10-18
Exploit-DB1
created 2020-03-17
Nuclei1
Zoho ManageEngine Desktop Central before 10.0.474 is vulnerable to a deserialization of untrusted data, which permits remote code execution.
yaml · seen 2026-10-18
On the wire
0 dispatchesNo dispatch on our wire has named this CVE yet.
Watch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.