CVE-2018-20753

What it actually does

Unprivileged remote attackers can execute arbitrary PowerShell payloads on all managed endpoints via the VSA RMM server without authentication.

Why it matters to the business

Attackers gain full control over every managed device, enabling rapid ransomware deployment across customer or internal networks; the issue remains actively exploited in ransomware campaigns with a past CISA deadline.

How an attack unfolds

Attackers send unauthenticated requests to vulnerable Kaseya VSA instances that cause the server to run attacker-supplied PowerShell code on every connected managed device; known threat actors have used this path in ransomware operations.

How to fix it

Upgrade Kaseya VSA to R9.3.0.35 or later for the R9.3 branch, R9.4.0.36 or later for the R9.4 branch, and R9.5.0.5 or later for the R9.5 branch; restrict network access to the VSA server until patches are applied.

How to confirm the fix worked

Confirm the installed VSA version meets or exceeds the fixed releases listed above; review server and agent logs for unexpected PowerShell execution originating from the RMM server.

Typical attack path

1. Identify exposed VSA RMM web interface or API endpoints
2. Craft and send unauthenticated requests containing PowerShell payloads
3. Server relays and executes payloads on all managed devices
4. Establish persistence and deploy ransomware or other payloads across the fleet

How to detect it

Search VSA server and managed endpoint logs for unexpected PowerShell execution triggered by the RMM service; review network traffic to the VSA server for anomalous unauthenticated requests around the time of known exploitation windows.

What your security team should do

• Immediately upgrade all VSA instances to the fixed versions
• Isolate VSA servers from the internet until upgrades are complete
• Scan managed device logs for prior unauthorized PowerShell activity
• Review and harden authentication and network exposure of the RMM platform