Kaseya VSA ConnectWise ManagedITSync Integration Unauthenticated SQL Injection and Remote Code Execution (CVE-2017-18362)
Executive & SecOps Summary
SECOPS ASSESSMENTConnectWise ManagedITSync integration through 2017 for Kaseya VSA with exposed ManagedIT.asmx page
Unauthenticated remote attackers can execute arbitrary SQL queries (read/write) on the Kaseya VSA database, leading to full system compromise and ransomware deployment across all managed endpoints
Immediately restrict external access to the ManagedIT.asmx page, apply official security patches, or disable the integration if not in use
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the latest official security updates from Kaseya and ConnectWise. If the integration is obsolete, remove the virtual directory from IIS using the following command:
# PowerShell command to remove the ManagedITSync application from IIS
Import-Module WebAdministration
Remove-WebApplication -Site 'Default Web Site' -Name 'ManagedITSync'2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict external access to the ManagedIT.asmx file using IIS URL Rewrite rules to allow only trusted IP addresses.
<!-- IIS web.config snippet to block external access to ManagedIT.asmx -->
<configuration>
<system.webServer>
<rewrite>
<rules>
<rule name='Restrict ManagedIT.asmx' stopProcessing='true'>
<match url='^.*ManagedIT\.asmx' />
<conditions>
<add input='{REMOTE_ADDR}' pattern='^192\.168\.1\.[0-9]+$' negate='true' />
</conditions>
<action type='CustomResponse' statusCode='403' statusReason='Forbidden' statusDescription='Access Denied' />
</rule>
</rules>
</rewrite>
</system.webServer>
</configuration>3. Log Audit & IoC Verification Commands
Inspect IIS W3C logs for unauthorized access attempts to the vulnerable endpoint and potential SQL injection patterns.
# Search IIS logs for access to ManagedIT.asmx and common SQL injection keywords
grep -i 'ManagedIT.asmx' /var/log/iis/*.log | grep -E -i '(union|select|insert|update|delete|char|declare)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists within the ManagedIT.asmx web service page, which serves as the integration interface between Kaseya VSA and ConnectWise ManagedITSync. The endpoint fails to perform proper authentication and input validation, allowing unauthenticated remote attackers to perform SQL Injection (CWE-89) directly against the backend Kaseya VSA database.
2. Exploitation Mechanics & Attack Scenario
An attacker targets the publicly accessible ManagedIT.asmx endpoint via the Kaseya VSA web interface. By sending crafted SOAP or HTTP POST requests containing malicious SQL payloads, the attacker bypasses authentication to execute arbitrary database queries. In active wild exploits, attackers leveraged this database access to inject commands into the VSA task queue, forcing the VSA server to push and execute ransomware payloads on all managed downstream endpoints.
3. Infrastructure & Business Impact
With a CVSS score of 9.8 (Critical) and inclusion in the CISA KEV catalog, this vulnerability represents an extreme risk. Successful exploitation allows complete takeover of the MSP (Managed Service Provider) infrastructure, enabling threat actors to deploy ransomware at scale, resulting in catastrophic operational downtime and data loss for both the provider and its clients.
Official Vendor Advisories & References
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.
Frequently Asked SecOps Questions (CVE-2017-18362)
FAQQ1. How critical is CVE-2017-18362 and is it actively exploited in the wild?
CVE-2017-18362 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 86.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2017-18362?
Primary impacted vendors include connectwise, kaseya across manageditsync, vsa. Scope summary: Kaseya VSA environments integrated with ConnectWise ManagedITSync through 2017 where ManagedIT.asmx is publicly accessible
Q3. What temporary mitigations or workarounds exist for CVE-2017-18362 before patching?
[Mitigation] Immediately restrict external access to the ManagedIT.asmx page, apply official security patches, or disable the integration if not in use Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2017-18362
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (connectwise)
View Category →LiteLLM Proxy Server SQL Injection Vulnerability (CVE-2026-42208) Security Advisory
[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7
ConnectWise ScreenConnect Client Remote Code Execution (RCE) and Privilege Escalation (CVE-2026-84869)
[Affected Scope] ConnectWise ScreenConnect client software (Servers are not impacted)
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Drupal Core SQL Injection Vulnerability (CVE-2026-9082) Critical Security Advisory
[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.