VULNERABILITY INTELLIGENCE

CVE-2018-20753

CVSS score9.8 CRITICAL

EPSS probability29.55%

CISA KEVKnown exploited vulnerability

Published2019-02-05

Last modified2026-08-13

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Kaseya VSA Remote Code Execution Vulnerability

Vendor / product: Kaseya / Virtual System/Server Administrator (VSA)

Description

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

Primary references

cve@mitre.org — Exploit, Third Party Advisory
cve@mitre.org — Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource