CVSS 9.8 CRITICAL Bulletin: Zoho Security Advisory Published: 2020-03-06

CVE-2020-10189: Zoho ManageEngine Desktop Central Untrusted Deserialization RCE

Technical intelligence and weaponization dossier for CVE-2020-10189. Documented exploitation across 1 active malware families totaling 2 analyzed telemetry samples.

Attributed Families

Sample Volume

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official NIST NVD

View NVD Record →

Vulnerability Specifications & Root Cause

Vulnerability ID	CVE-2020-10189
Common Name / Bulletin	Zoho ManageEngine Desktop Central Untrusted Deserialization RCE (`Zoho Security Advisory`)
CWE Classification	`CWE-502: Deserialization of Untrusted Data in FileUpload Servlet`
Affected Software & Versions	ManageEngine Desktop Central before build 10.0.474
Technical Root Cause	Deserialization flaw in the FileUpload servlet of Desktop Central allowing unauthenticated remote attackers to upload arbitrary files and execute code, weaponized zero-day by Winnti/APT41.
Associated ATT&CK Techniques	`T1190` — Associated ATT&CK Technique `T1059` — Associated ATT&CK Technique

Malware Families Weaponizing CVE-2020-10189

Empirical catalog telemetry verifies that the following 1 malware families weaponize this vulnerability for initial access, privilege escalation, or lateral movement:

1 families

Malware Family	Category	Catalog Samples	Operational Profile
winnti	Backdoor	`2`	Backdoor:Win32/Winnti is the flagship modular cyber espionage platform and kernel rootkit family utilized by Chinese state-nexus threat group APT41 (also tracke...

Attributed Threat Actors & Syndicates

Threat intelligence confirms the following adversaries weaponize CVE-2020-10189 in enterprise intrusions and campaign toolkits:

APT41 — Attributed Threat Group / Campaign Operator
Chinese MSS — Attributed Threat Group / Campaign Operator
Winnti Group — Attributed Threat Group / Campaign Operator

SOC Detection & Threat Hunting Guidance

Threat hunting leads and behavioral telemetry patterns to identify weaponized exploitation of CVE-2020-10189 in enterprise networks:

HTTP POST to /mdm/servlet/json?action=FileUpload with multipart files containing serialized Java objects (0xACED0005).

Remediation & Defensive Hardening

SOC containment checklist and attack surface reduction measures to neutralize exploitation:

Actionable Guidance: Upgrade Desktop Central to build 10.0.474 or higher; restrict administrative access to internal management networks.

For end-to-end incident response procedures, consult our dedicated playbook: Backdoor & RAT Protection for Businesses →

← Return to Vulnerability Matrix Directory (All 63 CVEs)