Kaseya VSA Remote Code Execution Vulnerability (CVE-2018-20753)

What is affected, what to do

The vulnerability CVE-2018-20753 allows remote code execution (RCE) in Kaseya VSA RMM versions prior to R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5. An attacker can execute PowerShell payloads on all managed devices without authorization. This vulnerability has been actively exploited in ransomware campaigns since 2018. All organizations using the affected Kaseya VSA versions are at risk. Immediate updating to the specified patch versions is crucial to mitigate the threat.

The vulnerability is being actively exploited; treat it as a priority. CISA lists it as used in ransomware campaigns. Update Kaseya Virtual System/Server Administrator (VSA) to version 9.3.0.35, Kaseya Virtual System/Server Administrator (VSA) to version 9.4.0.36, Kaseya Virtual System/Server Administrator (VSA) to version 9.5.0.5. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Kaseya Virtual System/Server Administrator (VSA) lt 9.3..9.3.0.35
• Kaseya Virtual System/Server Administrator (VSA) lt 9.4..9.4.0.36
• Kaseya Virtual System/Server Administrator (VSA) lt 9.5..9.5.0.5

Fixed in

• Kaseya Virtual System/Server Administrator (VSA) 9.3.0.35
• Kaseya Virtual System/Server Administrator (VSA) 9.4.0.36
• Kaseya Virtual System/Server Administrator (VSA) 9.5.0.5

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory every on-premises VSA server and upgrade immediately to at least R9.3 9.3.0.35, R9.4 9.4.0.36 or R9.5 9.5.0.5. These branches are long outdated, so move to the currently supported VSA release. Look up the target version in the Kaseya vendor advisory.
   • Pull unpatched VSA servers off the internet. Firewall the web console (TCP 443/80) so it is reachable only from the admin network or via VPN. Allow the agent check-in port (default TCP 5721) only from known agent networks.
   • Audit agent procedures and scheduled scripts. In the VSA console, review all Agent Procedures for unknown, recently created or modified entries that invoke PowerShell. Disable anything suspicious, then export and preserve it as evidence.
   • Reset all VSA credentials, including admin, master and API accounts. Enforce MFA, remove orphaned accounts and kill active sessions.
   • Triage managed endpoints, starting with servers and domain controllers. Look for PowerShell processes whose parent is AgentMon.exe and for files in C:\kworking\ that do not map to legitimate procedures.
   • If compromise is suspected: isolate the VSA server without powering it off and capture memory and disk images. Trigger NIS2 early-warning reporting within 24 h, or BSI reporting for KRITIS operators. If you are an MSP customer, also escalate to your provider.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Place the VSA server in a dedicated management segment. Allow inbound console access only from an admin jump-host network. Restrict the server's outbound traffic to the Kaseya update endpoints it actually needs.
   • WAF/reverse proxy: Front the VSA console with an authenticating proxy (IdP pre-auth or VPN). Block unauthenticated requests to console and API paths, and alert on anomalies such as unusual POSTs from external IPs.
   • Endpoint hardening: Enforce PowerShell Constrained Language Mode or AppLocker/WDAC on managed hosts. Allow execution from C:\kworking\ only for signed or allow-listed scripts. Enable the ASR rule that blocks obfuscated scripts.
   • IAM/least privilege: Split VSA roles so only a handful of accounts can author procedures or push them to machine groups. Never let the agent context hold domain-admin credentials.
   • Endpoint egress filtering: Block outbound connections to mining pools (Stratum protocol, common ports 3333/4444/14444) and to unknown download hosts at the proxy or firewall. The 2018 exploitation wave delivered cryptomining payloads.
3. 03

   Runbook step 3

   Detection rules

   • EDR/Sysmon EID 1 or Windows Event ID 4688: process chain AgentMon.exe → cmd.exe/powershell.exe with -enc, IEX, DownloadString or FromBase64String. KQL: DeviceProcessEvents | where InitiatingProcessFileName =~ "AgentMon.exe" and FileName in~ ("powershell.exe","pwsh.exe") and ProcessCommandLine has_any ("-enc","IEX","DownloadString","FromBase64String")
   • PowerShell Script Block Logging (Event ID 4104): script blocks containing download cradles or miner configuration (stratum+tcp, xmrig, pool), running as SYSTEM under the Kaseya agent service.
   • Fan-out execution: the same PowerShell command line or file hash in C:\kworking\ appears on many endpoints within minutes. SPL: index=edr parent_process_name=AgentMon.exe process_name=powershell.exe | stats dc(host) as hosts by cmdline | where hosts > 10
   • VSA web/IIS logs: requests from unapproved external IPs to console, procedure or API endpoints, especially without a preceding successful login. Also flag Agent Procedures created or scheduled outside maintenance windows (VSA audit log).
   • Network telemetry (Zeek/Suricata): outbound Stratum sessions or Suricata ET POLICY Crypto Coin Mining hits from managed endpoints. Also watch for new outbound TLS sessions from servers that normally talk only to the VSA server.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild.

Source: CISA KEV Catalog, cvelistv5, NVD (NIST)

Vendors and products

• Kaseya Kaseya Virtual System/Server Administrator (VSA)

References & sources

• blog.huntresslabs.comdeep-dive-kaseya-vsa-mining-payload-c0ac839a0e88x_refsource_MISC
• helpdesk.kaseya.comhc/en-gb/articles/360000333152x_refsource_MISC
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2018-20753government-resource