CVE-2018-20753 KEV
9.8
CRITICAL · CVSS 3.1 · EPSS 29.3% (pctl 98)
Patch first
On CISA KEV — known exploited in the wild, due 2022-05-04.
Description
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
Scoring
| CVSS | 9.8 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 29.34% — more likely to be exploited than 98% of all CVEs |
| On CISA KEV | yes — remediate by 2022-05-04 |
| Public exploit | none known |
| Published | 2019-02-05 |
| Last modified | 2026-08-13 |
CISA KEV
| Name | Kaseya VSA Remote Code Execution Vulnerability |
|---|---|
| Added | 2022-04-13 |
| Due | 2022-05-04 |
| Vendor / product | Kaseya / Virtual System/Server Administrator (VSA) |
| Ransomware use | known |
Affected (1)
| Vendor | Product |
|---|---|
| kaseya | virtual system administrator |
References
- https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
- https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
- https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
- https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753
→ the Explorer · watch your stack · NVD