CVE-2017-18362

CRITICAL9.8

CISA KEV

Published 2019-02-05 · Updated 2026-08-13 · Source cve@mitre.org

Description

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-89CWE-89

CISA Known-Exploited Vulnerability

Product: Kaseya — Virtual System/Server Administrator (VSA)

Name: Kaseya VSA SQL Injection Vulnerability

Date added: 2022-05-24 · Due: 2022-06-14

USED IN RANSOMWARE

Required action: The impacted product is end-of-life and should be disconnected if still in use.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-87121
lwIP TCP/IP Stack MQTT is vulnerable to an out-of-bounds write, which may allow an attacker to gain full code execution on the device.
2026-09-22 · score 9.8
CVE-2026-76709
A vulnerability exists in the internal administrative component of Analytics and Location Engine (ALE). Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to gain unauthorized write access to the file system with elevated privileges, potentially resulting in full system compromise.
2026-09-22 · score 9.8
CVE-2026-76708
A vulnerability exists in the Analytics and Location Engine (ALE) where the application and underlying operating system use default, hard-coded credentials for several administrative and system accounts. An unauthenticated remote attacker could exploit this vulnerability by attempting to log in using these known default credentials. Successful exploitation could result in an attacker gaining unauthorized access to the application's management interface and the underlying operating system, potentially leading to full system compromise.
2026-09-22 · score 9.8
CVE-2026-47116
LTSecurity LTK3500SF contains a hard-coded credentials vulnerability where root and guest account passwords are stored as reversible hashes in /etc/shadow, recoverable using dictionary-based cracking tools. Attackers can use the recovered credentials to authenticate via Telnet or SSH and obtain full root-level access to the operating system.
2026-09-22 · score 9.8
CVE-2026-28324
SolarWinds Observability Self-Hosted was found to be affected by an unauthenticated remote code execution vulnerability due to the insufficient integrity checks. Installations configured in a non-default and non-secure configuration are affected.
2026-09-22 · score 9.8