What’s Vulnerable › Vulnerabilities

CVE-2018-20753: Kaseya VSA Remote Code Execution Vulnerability

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2022-04-13
• EPSS: 29.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-02-05 · updated 2026-08-13

Description

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

Affected products

• Kaseya Virtual System Administrator: from 9.3 before 9.3.0.35; from 9.4 before 9.4.0.36; from 9.5 before 9.5.0.5 — fixed in 9.3.0.35, 9.4.0.36, 9.5.0.5

How to fix

Upgrade to a fixed version: Kaseya Virtual System Administrator 9.3.0.35, 9.4.0.36, 9.5.0.5. Check the vendor advisory for mitigations.

References

• https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
• https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
• https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
• https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753

Get alerted when CVE-2018-20753 or the next vulnerability affects your stack