Kaseya VSA RMM Remote Code Execution (RCE) and PowerShell Payload Execution Vulnerability (CVE-2018-20753)
Executive & SecOps Summary
SECOPS ASSESSMENTKaseya VSA R9.3 (before 9.3.0.35), R9.4 (before 9.4.0.36), and R9.5 (before 9.5.0.5)
Unprivileged remote attackers can execute arbitrary PowerShell payloads with SYSTEM privileges on all managed endpoints
Immediately upgrade Kaseya VSA servers to patched versions (9.3.0.35, 9.4.0.36, 9.5.0.5 or higher) and restrict external access
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security updates provided by Kaseya immediately. Stop the services and run the patch installer to upgrade your VSA instance.
# Stop Kaseya VSA services before applying the patch
Stop-Service -Name 'KaseyaEdgeServices' -Force
Stop-Service -Name 'KaseyaService' -Force
# Download and execute the official KaseyaPatch.exe from the Kaseya Help Desk
# Minimum safe versions: R9.3 (9.3.0.35+), R9.4 (9.4.0.36+), R9.5 (9.5.0.5+)
Start-Process -FilePath '.\KaseyaPatch.exe' -ArgumentList '/quiet /norestart' -Wait2. Temporary Workaround & Hardening Configuration
If patching cannot be applied immediately, restrict access to the Kaseya VSA web interface (ports 80 and 443) using a firewall or reverse proxy, allowing connections only from trusted IP addresses or VPN subnets.
# Example Nginx configuration to restrict access to sensitive VSA API endpoints
location /api/v1.0/ {
allow 10.0.0.0/8;
allow 192.168.0.0/16;
deny all;
}3. Log Audit & IoC Verification Commands
Inspect Windows Event Logs on managed endpoints and VSA servers for suspicious PowerShell execution patterns associated with this exploit.
# Query PowerShell Operational logs for suspicious download or bypass commands
Get-WinEvent -FilterHashtable @{
LogName='Microsoft-Windows-PowerShell/Operational'
Id=4104
} | Where-Object { $_.Message -match 'DownloadString' -or $_.Message -match 'bypass' } |
Select-Object TimeCreated, Id, Message | Format-ListBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
CVE-2018-20753 is a critical remote code execution (RCE) vulnerability in the Kaseya VSA Remote Monitoring and Management (RMM) platform. The root cause lies in broken access control and missing authentication validation within specific API endpoints of the VSA web application. This flaw allows unauthenticated remote attackers to bypass security controls and issue administrative commands directly to the VSA server.
2. Exploitation Mechanics & Attack Scenario
An attacker sends crafted HTTP requests to an internet-facing Kaseya VSA server. By exploiting the unauthenticated endpoints, the attacker triggers the VSA agent command distribution mechanism. In-the-wild exploitation campaigns leveraged this vulnerability to push malicious PowerShell payloads to all downstream managed endpoints, deploying Monero cryptocurrency miners and ransomware across entire client networks managed by the VSA instance.
3. Infrastructure & Business Impact
Because Kaseya VSA is widely used by Managed Service Providers (MSPs) to manage IT infrastructure for numerous clients, this vulnerability has systemic supply-chain implications. Compromising a single VSA server grants the attacker full administrative control over thousands of client endpoints, bypassing local endpoint security controls and leading to widespread ransomware deployment, data exfiltration, and severe business disruption. This vulnerability is actively tracked in the CISA KEV catalog.
Official Vendor Advisories & References
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.
Frequently Asked SecOps Questions (CVE-2018-20753)
FAQQ1. How critical is CVE-2018-20753 and is it actively exploited in the wild?
CVE-2018-20753 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 29.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2018-20753?
Primary impacted vendors include kaseya across vsa. Scope summary: All on-premises Kaseya VSA servers running versions R9.3 prior to 9.3.0.35, R9.4 prior to 9.4.0.36, and R9.5 prior to 9.5.0.5
Q3. What temporary mitigations or workarounds exist for CVE-2018-20753 before patching?
[Mitigation] Immediately upgrade Kaseya VSA servers to patched versions (9.3.0.35, 9.4.0.36, 9.5.0.5 or higher) and restrict external access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2018-20753
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (kaseya)
View Category →Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
WSO2 JWT Authentication Bypass and Account Takeover (CVE-2026-5430)
[Affected Scope] WSO2 Identity Server, API Manager, and products utilizing WSO2 JWT authentication modules.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.