Zoho ManageEngine ServiceDesk Plus before 11306 ServiceDesk Plus MSP before 10530 and SupportCenter Plus before 11014 are vulnerable to unauthenticated remote code execution. This is related to /RestAPI URLs in a servlet and ImportTechnicians in the Struts configuration.