{"id":"CVE-2020-10189","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-10189","generatedAt":"2026-10-31T17:24:43.192Z","title":"Zoho ManageEngine Desktop Central File Upload Vulnerability","description":"Zoho ManageEngine Desktop Central before 10.0.474 allows remote code execution because of deserialization of untrusted data in getChartImage in the FileStorage class. This is related to the CewolfServlet and MDMLogUploaderServlet servlets.","published":"2020-03-06T17:15:12.000Z","lastModified":"2026-06-17T02:47:28.000Z","status":"Analyzed","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-502"],"affected":["zohocorp/manageengine desktop central"],"epss":{"score":0.99941,"percentile":0.99972,"date":"2026-10-30","history":[]},"kev":{"listed":true,"dateAdded":"2021-11-03","dueDate":"2022-05-03","knownRansomwareCampaignUse":"Unknown","notes":"Apply updates per vendor instructions.\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-10189"},"exploits":{"count":1,"verified":true,"firstPublished":"2020-03-17","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":48224,"kind":"exploit","title":"ManageEngine Desktop Central - Java Deserialization (Metasploit)","url":"https://www.exploit-db.com/exploits/48224","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/multiple/remote/48224.rb","file":"exploits/multiple/remote/48224.rb","published":"2020-03-17","added":"2020-03-17","updated":"2020-03-17","author":"Metasploit","type":"remote","platform":"multiple","port":null,"verified":true,"codes":["CVE-2020-10189"],"tags":"Metasploit Framework (MSF)","aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":"https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/windows/http/desktopcentral_deserialization.rb"}]},"verdict":{"level":"urgent","text":"Known to be exploited in the wild (CISA KEV, CISA remediation deadline 3 May 2022). Treat as an emergency change: patch or isolate now, then hunt for prior compromise."},"changes":[],"references":[{"url":"http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"cve@mitre.org"},{"url":"https://cwe.mitre.org/data/definitions/502.html","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://srcincite.io/advisories/src-2020-0011/","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://srcincite.io/pocs/src-2020-0011.py.txt","tags":["Exploit","Third Party Advisory"],"source":"cve@mitre.org"},{"url":"https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/","tags":["Third Party Advisory"],"source":"cve@mitre.org"},{"url":"http://packetstormsecurity.com/files/156730/ManageEngine-Desktop-Central-Java-Deserialization.html","tags":["Exploit","Third Party Advisory","VDB Entry"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://cwe.mitre.org/data/definitions/502.html","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://srcincite.io/advisories/src-2020-0011/","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://srcincite.io/pocs/src-2020-0011.py.txt","tags":["Exploit","Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.manageengine.com/products/desktop-central/remote-code-execution-vulnerability.html","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.zdnet.com/article/zoho-zero-day-published-on-twitter/","tags":["Third Party Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-10189","tags":["US Government Resource"],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-10189","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}