Live › vulnerability › CVE-2017-18362
Go to dashboardUnauthenticated SQL injection in the ConnectWise ManagedITSync integration (ManagedIT.asmx) for on-premises Kaseya VSA. Anyone who can reach the page can read and write the VSA database, which lets them create admin users or push tasks to every managed endpoint. Exploited in the wild since Feb 2019 to deploy GandCrab ransomware. In CISA KEV.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
The impacted product is end-of-life and should be disconnected if still in use.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Kaseya Virtual System/Server Administrator (VSA) | vendor | – | – |
| ConnectWise ManagedITSync integration for Kaseya VSA | vendor | <= 2017 (NVD CPE, all versions up to and including 2017) | – |
ConnectWise MSP Kaseya Web Service in Add or Remove Programs, or for the file ManagedIT.asmxEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.
This page as .md · .json · in your agent: get_signal("CVE-2017-18362")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.