CVE-2018-20753

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

Kaseya VSA RMM, a remote monitoring and management platform, is affected by CVE-2018-20753 in versions prior to R9.3 9.3.0.35, R9.4 9.4.0.36, and R9.5 0.5. The flaw permits unauthenticated remote attackers to execute arbitrary PowerShell payloads across all devices under management, carrying a CVSS 3.1 base score of 9.8 that reflects network-accessible attack vectors with no required privileges or user interaction.

An attacker who reaches the VSA server can leverage the weakness to run code on every managed endpoint, resulting in full compromise of confidentiality, integrity, and availability on those systems. Because the payloads execute with the privileges of the management agent, the attacker effectively gains control over the entire customer fleet without needing credentials on individual devices.

Kaseya’s advisory and corresponding patches direct administrators to upgrade to the fixed builds listed above. The vulnerability is also catalogued in CISA’s Known Exploited Vulnerabilities list, underscoring the need for immediate remediation on any remaining unpatched instances.

Public reporting confirms that the issue was actively exploited in the wild as early as January 2018, with observed campaigns deploying cryptocurrency miners via the PowerShell execution path.