CVE-2018-20753

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - cve@mitre.org

Published

2019-02-05

Last modified

2026-08-13

Known exploited (CISA KEV)

since 2022-04-13, action due 2022-05-04: Apply updates per vendor instructions.

Affected products

• Virtual System Administrator (Kaseya)

References

• https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88
• https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753