Live monitoring Updated 72-hour alert levelMajor alert Editor: Frédéric LENQUETTE
CYBERIACKCybersecurity & AI intelligence · by Frédéric LENQUETTE

Vendor

Kaseya: actively exploited vulnerabilities

3 vulnerabilities in Kaseya products are listed in CISA’s catalog of actively exploited vulnerabilities, 3 of them used by ransomware. Latest addition on May 24, 2022: CVE-2017-18362 (Virtual System/Server Administrator (VSA)).

Affected products

  • Virtual System/Server Administrator (VSA)3

All exploited vulnerabilities

CISA KEV catalog, newest first: each entry corresponds to observed exploitation.

2022 2 vulnerabilities

  1. CVE-2017-18362Used by ransomware

    Kaseya VSA SQL Injection Vulnerability

    NVD entryCISA catalog

  2. CVE-2018-20753Used by ransomware

    Kaseya VSA Remote Code Execution Vulnerability

    NVD entryCISA catalog

2021 1 vulnerability

  1. CVE-2021-30116Used by ransomware

    Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability

    NVD entryCISA catalog

What to do

If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.

Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.