Secuno
ENNL
Book demo

CVE-2017-18362

Kaseya VSA SQL Injection

9.8 CRITICALActively exploited (CISA KEV)Used in ransomwarePublic exploitEPSS 86.8%
  1. Published5 Feb 2019
  2. Added to CISA KEV24 May 2022
  3. Remediation due14 Jun 2022
Actively exploited (CISA KEV)

ConnectWise ManagedITSync integration for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database.

Added to KEV: 24 May 2022Federal remediation due: 14 Jun 2022Used in ransomware

Description

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeUnchanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

ConnectWise Manageditsync≤ 2017

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-893028.6
The Post Voting System WordPress plugin through 1.0 does not properly sanitize and…
CVE-2026-892998.6
The WP Verify API WordPress plugin through 1.0.0 does not properly sanitize and escape…
CVE-2026-892978.6
The Loja Automática WordPress plugin through 1.0.0 does not properly sanitize and…
CVE-2026-892878.6
The ASPL Product Quotation WordPress plugin through 1.1.0 does not sanitize and escape…
CVE-2026-892858.6
The Datalist it WordPress plugin through 0.0.3 does not sanitize and escape several…
CVE-2026-892348.6
The WP-Partner WordPress plugin through 1.2.1 does not sanitise and escape a parameter…

Frequently asked

Is CVE-2017-18362 being actively exploited?

Yes. CVE-2017-18362 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added 24 May 2022. It has been used in ransomware campaigns.

How severe is CVE-2017-18362?

CVE-2017-18362 has a CVSS 3.1 base score of 9.8, rated critical. EPSS estimates a 86.8% probability of exploitation.

Which products are affected by CVE-2017-18362?

Affected products include ConnectWise Manageditsync.

How do I fix CVE-2017-18362?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2017-18362 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. Because it is on the CISA KEV list, Secuno flags any affected asset as top-priority automatically. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.