Loading story…
Attackers exploited CVE-2019-8394 in Zoho ManageEngine ServiceDesk Plus to upload web shells and compromise networks despite a patch released in early 2019, according to SOC Prime’s December 2020 report. The vulnerability affects versions before 10.0 build 10012 and involves insufficient sanitization of user-supplied input in crafted SMTP requests. Exploitation requires authentication but can be performed with minimal privileges, including guest credentials, enabling arbitrary system command execution.
Web shells can give attackers persistent access to affected servers and support further network compromise. Organizations running vulnerable builds should upgrade to a patched version and investigate exposed systems for unauthorized web shells; patching alone does not remove an existing compromise. SOC Prime also pointed defenders to NSA and Australian Signals Directorate guidance on detecting and preventing web shell malware, providing complementary measures for identifying malicious server-side files and reducing opportunities for persistent access.
See which actors are running it and whether you're in range.
3 events from the most recent confirmed update back to the earliest known activity.
CVE-2019-8394 was disclosed on February 18, 2019, affecting versions before 10.0 build 10012. Insufficient sanitization of crafted SMTP requests allows an authenticated attacker with minimal permissions to upload web shells and execute arbitrary system commands.
Zoho released a patch for CVE-2019-8394 in Q1 2019. ServiceDesk Plus version 10.0 build 10012 or later addresses the vulnerability.
Threat actors began exploiting CVE-2019-8394 immediately after its disclosure, using the vulnerability to upload web shells. These shells can provide persistent access and facilitate further network compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited **CVE-2022-47966**, a pre-authentication remote code execution vulnerability affecting at least 24 on-premises ManageEngine products, to compromise servers and establish persistent access. The flaw stems from Apache Santuario and is exploitable under product-specific SAML single sign-on configuration conditions. ManageEngine released patches in October and November 2022, but Rapid7 observed exploitation beginning January 17, 2023—two days before Horizon3 published proof-of-concept code and a technical analysis. Observed attacks deployed webshells, established persistent tunnels, created privileged accounts, weakened credential protections, and disabled security controls. Additional exploitation involved Agent Tesla download activity, Monero mining, and PowerShell reverse shells. Organizations operating affected products should apply the appropriate vendor updates and assess exposure against ManageEngine’s product-specific SAML conditions. Previously unpatched systems warrant investigation using documented logs, process behavior, and network indicators; patching alone does not remove attacker-created accounts, webshells, or other persistence mechanisms.
Oct 9, 2026
Microsoft attributed a targeted campaign exploiting **CVE-2021-40539** in Zoho ManageEngine ADSelfService Plus to the China-based threat group **DEV-0322** with high confidence. First observed on September 22, 2021, the campaign targeted organizations apparently operating in the defense industrial base, higher education, consulting, and information technology sectors. Following exploitation, attackers dumped credentials, moved laterally, and installed a custom IIS backdoor capable of executing commands, transferring files, and capturing authentication credentials. DEV-0322 also deployed **Zebracon**, a Trojan that retrieves commands through an attacker-controlled mailbox hosted on suspected compromised Zimbra email servers. Microsoft published malware detections, hunting queries, and file-hash indicators to support investigations. Organizations running ADSelfService Plus should verify remediation of CVE-2021-40539 and investigate exposed installations for credential theft, lateral movement, and persistent backdoors; patching alone does not remove an existing compromise.
Oct 9, 2026
Dutch authorities warned that attackers are actively exploiting **CVE-2024-45519** in Zimbra Collaboration. A specially crafted email sent to a vulnerable Zimbra server can trigger arbitrary code execution, allowing an attacker to compromise the mail platform without requiring user interaction. Successful exploitation can be used to deploy webshells for persistent remote access. Synacor has issued security updates, and organizations should patch affected Zimbra installations immediately, hunt for webshells and other post-exploitation artifacts, and increase monitoring; patching alone will not remove webshells implanted before remediation.
Sep 3, 2026