TI-2018-14728 Aliases CVE-2018-20753 GHSA-hhg2-f289-m44w

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows…

CRITICAL 100Exploited in the wildPublished 2019-02-05 · Updated 2026-08-13

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

Why it matters now

Exploitation Active In CISA KEV since 2022-04-13CISA due date 2022-05-04Known ransomware use

EPSS 0.29551 98th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Active
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:kaseya:virtual_system_administrator::::::::	9.3 to before 9.3.0.35; 9.4 to before 9.4.0.36; 9.5 to before 9.5.0.5	Vulnerable	Kaseya

cpe:2.3:a:kaseya:virtual_system_administrator:*:*:*:*:*:*:*:* Versions 9.3 to before 9.3.0.35; 9.4 to before 9.4.0.36; 9.5 to before 9.5.0.5 Vulnerable ·Kaseya

Remediation

No fixed version listed by the sources yet.

Timeline

2022-04-13 Added to CISA KEV
2026-10-02 Threatist record created from CVE-2018-20753
2026-10-03 Alias added: GHSA-hhg2-f289-m44w

References

Exploit 1

https://blog.huntresslabs.com/deep-dive-kaseya-vsa-mining-payload-c0ac839a0e88

Advisory 1

https://helpdesk.kaseya.com/hc/en-gb/articles/360000333152

TI-2015-05774 Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0… CVSS 3.1CRITICAL 9.8
TI-2015-05525 Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0… CVSS 3.1HIGH 8.8
TI-2019-11608 An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. CVSS 3.0HIGH 7.5
TI-2015-02528 Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before… CVSS 2.0MEDIUM 4.3
TI-2017-09153 It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning… CVSS 3.0HIGH 7.4
TI-2015-02527 Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before… CVSS 2.0MEDIUM 4.0

See all 7 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences