CVE-2018-20753

Kaseya VSA (Virtual System/Server Administrator), a remote monitoring and management platform used heavily by managed service providers, contains a remote code execution flaw that allows unprivileged remote attackers to execute attacker-supplied PowerShell payloads. An attacker who can reach a VSA server over the network can trigger execution without privileged access, and because VSA orchestrates agents on enrolled machines, the payload can run on all devices that server manages. Successful exploitation therefore yields code execution on the RMM server itself and potentially across an entire downstream managed estate, making it a high-value foothold for ransomware. Any organization running the affected product is exposed - most commonly MSPs and internal IT departments - along with every client device managed by a compromised VSA instance. CISA added the flaw to the KEV catalog on 2022-04-13 with known ransomware use; no public proof-of-concept is known.

What to do: Apply updates per Kaseya's instructions as required by the CISA KEV listing, upgrading VSA to the latest patched release rather than relying on partial mitigations, since this platform has a history of critical flaws. Restrict direct internet exposure of VSA servers (firewall/VPN only) and hunt on managed endpoints for unexpected PowerShell execution or newly created agent procedures, given the known ransomware use.