# CVE-2018-20753: Kaseya VSA Remote Code Execution Vulnerability

Source: https://junglewise.ai/threats/cve-2018-20753-kaseya-vsa-remote-code-execution-vulnerability  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-04-13. Updated: 2026-05-10  
License: CC BY 4.0 with a link back

CVE-2018-20753 · Severity: critical · CVSS 9.8 · Exploited in the wild · Published 2022-04-13

Kaseya VSA RMM contains a remote code execution vulnerability that allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. The flaw stems from insufficient access control, enabling attackers to bypass authentication and run arbitrary commands.

Technologies: [Kaseya Server Administrator (VSA)](https://junglewise.ai/threats/technologies/server-administrator-vsa), [Kaseya Virtual System](https://junglewise.ai/threats/technologies/virtual-system). Vendors: [Kaseya](https://junglewise.ai/threats/vendors/kaseya).

## Quick answers

**Is CVE-2018-20753 exploited in the wild?** Yes. CVE-2018-20753 is known to be exploited in the wild, first recorded on 13 April 2022. Treat it as urgent.

**How severe is CVE-2018-20753?** Critical severity, with a CVSS score of 9.8, published 13 April 2022.

**Which products and versions are affected?** Kaseya VSA RMM before 9.3.0.35, 9.4 before 9.4.0.36, and 9.5 before 9.5.0.5.

**Is there a fix for CVE-2018-20753?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2018-20753 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2018-20753?** Check whether you run Kaseya Server Administrator (VSA), Kaseya Virtual System or Kaseya Virtual System/Server Administrator (VSA). Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Kaseya VSA RMM before 9.3.0.35, 9.4 before 9.4.0.36, and 9.5 before 9.5.0.5

## Timeline

- 2018-01: exploited: Attackers actively exploited this vulnerability in the wild.
- 2019-02-05: disclosed: NVD Published Date
- 2022-04-13: kev added: Date added to CISA Known Exploited Vulnerabilities Catalog

## Related threats

- [Kaseya VSA SQL Injection Vulnerability](https://junglewise.ai/threats/cve-2017-18362-kaseya-vsa-sql-injection-vulnerability)
- [Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability](https://junglewise.ai/threats/cve-2021-30116-kaseya-virtual-system-server-administrator-vsa-information)