TI-2017-13536 Aliases CVE-2017-18362 GHSA-w35f-w5cg-jqhh

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to…

CRITICAL 100Exploited in the wildCWE-89Published 2019-02-05 · Updated 2026-08-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: SQL injection
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-89.

Summary

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

Why it matters now

Exploitation Active In CISA KEV since 2022-05-24CISA due date 2022-06-14Known ransomware use

EPSS 0.8682 99th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:connectwise:manageditsync::::::kaseya_vsa::*	up to 2017	Vulnerable	ConnectWise

cpe:2.3:a:connectwise:manageditsync:*:*:*:*:*:kaseya_vsa:*:* Versions up to 2017 Vulnerable ·ConnectWise

Remediation

No fixed version listed by the sources yet.

Timeline

2022-05-24 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2017-18362
2026-10-03 Alias added: GHSA-w35f-w5cg-jqhh

References

Exploit 1

https://github.com/kbni/owlky

Advisory 2

TI-2021-10669 2FA bypass in Kaseya VSA <= v9.5.6 CVSS 3.1CRITICAL 9.9
TI-2021-10665 Unauthenticated credential leak and business logic flaw in Kaseya VSA <= v9.5.6 KEVCVSS 3.1CRITICAL 10.0
TI-2018-14728 Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows… KEVCVSS 3.1CRITICAL 9.8
TI-2021-10668 Authenticated Authenticated reflective XSS in Kaseya VSA <= v9.5.6 CVSS 3.1MEDIUM 5.4
TI-2015-05774 Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0… CVSS 3.1CRITICAL 9.8
TI-2017-09213 It was discovered that the api/storage web interface in Unitrends Backup (UB) before… CVSS 3.1CRITICAL 9.8

See all 36 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences