CVE-2018-20753

Think of Kaseya VSA like the “remote control hub” your IT team uses to manage computers you support. This vulnerability lets an attacker use that hub to push commands that run PowerShell on all managed devices, which is a common stepping stone to ransomware and full device compromise.

This matters if your business uses or runs Kaseya VSA (Virtual System Administrator) to manage endpoints (workstations/servers) remotely. The risk is highest when a vulnerable VSA version is reachable in the way attackers typically use (for example, exposed network access), because the flaw can be triggered remotely to act across managed devices. It is especially dangerous when your environment matches what was targeted in ransomware activity—meaning attackers can reach the VSA system and exploit the vulnerable version.

This is a RED issue because it is confirmed to have been used in ransomware campaigns and appears in the CISA KEV list. Attackers can remotely run PowerShell through the VSA system, which can quickly turn into widespread compromise of devices you manage. Treat the fix as urgent and schedule the upgrade immediately for any vulnerable Kaseya VSA version.

1. Confirm exposure

• Locate the Kaseya VSA (Virtual System Administrator) server (the system that runs VSA/RMM).
• Check the installed version number.

2. Determine whether you are vulnerable

• Vulnerable if your Kaseya VSA version is:
  • before 9.3.0.35, OR
  • before 9.4.0.36, OR
  • before 9.5.0.5.

3. Upgrade to the fixed versions

• Upgrade to one of the fixed releases:
  • 9.3.0.35 (or later) for the 9.3 branch, or
  • 9.4.0.36 (or later) for the 9.4 branch, or
  • 9.5.0.5 (or later) for the 9.5 branch.
• Use the vendor’s provided remediation steps and follow any upgrade ordering they specify.
• After upgrade, validate that the VSA service is running and that managed devices reconnect normally.

4. If you cannot patch right away (temporary containment)

• Reduce exposure of the VSA server: remove or restrict unnecessary inbound access from the public internet and limit network paths to only what your operation requires.
• Contact Kaseya support/vendor helpdesk for an interim mitigation plan aligned to CVE-2018-20753.

5. What to monitor after patching

• Confirm normal VSA operation and managed-device check-ins.
• Review logs for unusual remote activity around the time of the upgrade and look for signs of attacker activity that may have occurred before patching.

6. KEV timing

• CISA listed this in KEV with a remediation due date of 2022-05-04; if you are still on a vulnerable version, prioritize closing it immediately.

CVE-2018-20753 is a Kaseya VSA (Virtual System Administrator) RMM vulnerability that enabled remote execution of PowerShell payloads by unprivileged remote attackers, affecting managed devices. It is listed in CISA KEV as being used in ransomware campaigns (added 2022-04-13), with a CISA remediation due date of 2022-05-04 and required action: apply vendor updates. While no public exploit code is noted in the findings, real-world exploitation is indicated by KEV listing. The traffic-light verdict for this CVE is RED, reflecting confirmed threat use rather than theoretical risk.