CVE-2021-44515

Zoho Desktop Central had an authentication bypass vulnerability allowing arbitrary code execution on the MSP server.

An authentication bypass in Zoho Desktop Central allowed attackers to execute arbitrary code on the MSP server, representing a critical security failure. DIB organizations must ensure their MSP tools are patched and monitored for such vulnerabilities to prevent unauthorized access and data compromise. This failure highlights the risk of relying on vendors with a history of unpatched critical vulnerabilities.

Shame score — The vulnerability allowed arbitrary code execution via an authentication bypass, and Zoho has a documented history of similar critical and high-severity RCE vulnerabilities across its product line.