{"id":"CVE-2021-30120","published":"2021-07-09T13:22:17Z","modified":"2026-08-14T03:55:29Z","title":"2FA bypass in Kaseya VSA <= v9.5.6","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained a password of a user and used an intercepting proxy (e.g. Burp Suite) to change the value of MFARequered from True to False, there is no prompt for the second factor, but the user is still logged in.","provenance":"source","from":"CVE.org"},"summary":{"text":"Kaseya VSA before 9.5.7 enforces its two-factor authentication requirement on the client side, allowing the MFA check to be bypassed. An attacker with network access and a valid username and password can use an intercepting proxy to flip the server's MFARequired response from True to False, which skips the second-factor prompt and logs them in.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:15:34Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.05701,"percentile":0.92992,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2021-07-06","exploitedFirstSeen":"2021-07-06","ransomware":true,"evidence":[{"url":"https://www.tenable.com/blog/cve-2021-30116-multiple-zero-day-vulnerabilities-in-kaseya-vsa-exploited-to-distribute-ransomware","date":"2021-07-06"},{"url":"https://threatpost.com/kaseya-patches-zero-days-revil-attacks/167670/","date":"2021-07-12"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/csw_final_ransomware_index-update-q321-csw_.pdf","date":"2021-11-10"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","date":"2022-05-18"},{"url":"https://static.tenable.com/marketing/whitepapers/Whitepaper-Ransomware_Ecosystem.pdf","date":"2022-06-22"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"},{"url":"https://previdian.com/CVE-2021-30120","date":"2026-08-14"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":2,"pulses":[{"name":"SCANID: S-KhOoOrXsco8: Thor Lite Linux 64 - Sample Lab Device 2 - incomplete (not enriched)","url":"https://otx.alienvault.com/pulse/67c6bb5aa601e91b1314ff44","created":"2025-03-04"},{"name":"Thor Lite Scan - 10.7.15 - Ubuntu Scan on Archived Files","url":"https://otx.alienvault.com/pulse/664cc3c1938ed0b9abf026a2","created":"2024-05-21"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://csirt.divd.nl/2021/07/07/Kaseya-Limited-Disclosure/","tags":["x_refsource_CONFIRM"]},{"url":"https://csrit.divd.nl/DIVD-2021-00011","tags":["x_refsource_CONFIRM"]},{"url":"https://csrit.divd.nl/CVE-2021-30120","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[{"id":"SRC-859cbc7ab52c526327fa","title":"The cyber threat from supply chains - Canadian Centre for Cyber Security","publisher":"cyber.gc.ca","url":"https://www.cyber.gc.ca/en/guidance/cyber-threat-supply-chains","date":null,"mentions":[{"quote":"The 2021 Kaseya VSA compromise by REvil used several zero-day vulnerabilities, including CVE-2021-30116Footnote 4 and CVE-2021-30120,Footnote 5 which allowed them to bypass authentication requirements to access VSA servers en route to deploying ransomware in up to 1500 downstream client networks.Footnote 6","start":11029,"end":11336},{"quote":"“CVE-2021-30120 Detail.”","start":35130,"end":35154}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2021-17060","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-17060","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-07-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.tenable.com/blog/cve-2021-30116-multiple-zero-day-vulnerabilities-in-kaseya-vsa-exploited-to-distribute-ransomware","provenance":"source"},{"date":"2021-07-09","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-30120","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":75.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1941 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":18.6,"detail":"percentile 0.9299"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.08,"detail":"2 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}