Kaseya vulnerabilities
We track 2 vulnerabilities in Kaseya products across 3 products. 2 are rated high or critical, and 2 have been exploited in real attacks. The most recent was published on July 9, 2021.
2vulnerabilities
2critical
0high
2exploited
9.8average CVSS score
Latest Kaseya vulnerabilities
- 9.8 Critical severity
Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Exploited
Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.a
- 9.8 Critical severity
Kaseya VSA Remote Code Execution Exploited
Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.