ACTIVELY EXPLOITED3 sources verified·1 min read
By Lyrie Threat Intelligence·12/1/2021
CVE-2021-37415 added to CISA KEV: Zoho ManageEngine ServiceDesk Plus (SDP)
Status: ✅ Confirmed exploited in the wild
Date added: 2021-12-01
Required action: Apply updates per vendor instructions.
Due date: 2021-12-15
Why this matters
Zoho ManageEngine ServiceDesk Plus before 11302 is vulnerable to authentication bypass that allows a few REST-API URLs without authentication
Sources
Lyrie Verdict
Lyrie's autonomous detection layer catches active exploitation primitives at machine speed — closing the gap between disclosure and weaponization that traditional defense simply can't cover.