Actively exploited in the wild
Kaseya VSA Remote Code Execution Vulnerability
Kaseya - Virtual System/Server Administrator (VSA) · Listed in the CISA KEV since 2022-04-13. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-20753
CriticalCVSS 9.8KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
Risk Assessment
An unprivileged attacker can execute arbitrary PowerShell code on all managed devices, potentially leading to full infrastructure compromise.
Recommendation
Update Kaseya VSA to a patched version (R9.3 9.3.0.35 or later, R9.4 9.4.0.36 or later, R9.5 9.5.0.5 or later).
Original NVD description (English source)
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.