{"id":"CVE-2018-20753","published":"2019-02-05T06:29:00Z","modified":"2026-08-13T05:17:18Z","title":"Kaseya VSA Remote Code Execution Vulnerability","vendor":"Kaseya","product":"Virtual System/Server Administrator (VSA)","tier":"core","eol":null,"description":{"text":"Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.","provenance":"source","from":"NVD"},"summary":{"text":"The Kaseya VSA remote monitoring and management product contains a remote code execution flaw in its component handling, affecting versions before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5. An unprivileged remote attacker with network access can execute PowerShell payloads on all managed devices, requiring no authentication or user interaction.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:57:58Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.29551,"percentile":0.98181,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-04-13","dueDate":"2022-05-04","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2018-20753","provenance":"source"},"vulncheckKev":{"dateAdded":"2018-01-30","exploitedFirstSeen":"2018-01-30","ransomware":true,"evidence":[{"url":"https://medium.com/huntresslabs/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88","date":"2018-01-30"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-04-13"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88","tags":["Exploit","Third Party Advisory"]},{"url":"https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152","tags":["Vendor Advisory"]},{"url":"https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88","tags":["Exploit","Third Party Advisory"]},{"url":"https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753","tags":["US Government Resource"]}],"techniques":[{"id":"T1212","name":"Exploitation for Credential Access","tactics":["credential-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Remote unauthenticated exploitation of public-facing RMM server","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows unprivileged remote attackers to execute PowerShell payloads","start":83,"end":150}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059.001","name":"PowerShell","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Direct PowerShell payload execution on managed devices","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allows unprivileged remote attackers to execute PowerShell payloads","start":83,"end":150}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-13296","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-13296","exploited":true,"exploitedSince":"2022-04-13","provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":["https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059.001"],"provenance":"ai"},{"stage":"related","techniques":["T1212"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2018-01-30","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://medium.com/huntresslabs/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88","provenance":"source"},{"date":"2019-02-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20753","provenance":"source"},{"date":"2022-04-13","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-04-13","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-13296","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1163},"priority":{"score":79.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3194 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.64,"detail":"percentile 0.9818"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}