---
id: "CVE-2017-18362"
kind: "vulnerability"
aliases: ["CVE-2017-18362"]
title: "Kaseya Virtual System/Server Administrator (VSA): Kaseya VSA SQL Injection Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.8682
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Kaseya Virtual System/Server Administrator (VSA)", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "ConnectWise ManagedITSync integration for Kaseya VSA", "fixed": [], "affected": "<= 2017 (NVD CPE, all versions up to and including 2017)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["connectwise", "end-of-life", "exploited", "kaseya-vsa", "msp", "ransomware", "self-hosted", "vendor"]
not_affected_if: ["cloud-hosted", "integration-not-installed", "managed-hosting", "managedtitsync-integration-not-used", "vsa-not-deployed"]
published_at: "2019-02-05T06:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18362", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2017-18362", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T21:16:22+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18362", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Kaseya Virtual System/Server Administrator (VSA): Kaseya VSA SQL Injection Vulnerability

Unauthenticated SQL injection in the ConnectWise ManagedITSync integration (ManagedIT.asmx) for on-premises Kaseya VSA. Anyone who can reach the page can read and write the VSA database, which lets them create admin users or push tasks to every managed endpoint. Exploited in the wild since Feb 2019 to deploy GandCrab ransomware. In CISA KEV.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kaseya Virtual System/Server Administrator (VSA) affected ? fixed ?
- vendor:ConnectWise ManagedITSync integration for Kaseya VSA affected <= 2017 (NVD CPE, all versions up to and including 2017) fixed ?

## How to check

On the VSA server, look for 'ConnectWise MSP Kaseya Web Service' in Add or Remove Programs, or for the file ManagedIT.asmx. Or browse to https://<vsa-host>/kaseyacwwebservice/managedit.asmx; if the page loads, you are exposed. Snort SID 1:60119 detects exploit attempts against /KaseyaCwWebService/ManagedIT.asmx. Kaseya once published a checker tool, which I could not retrieve.

## Fix

Disconnect the VSA server from the internet and audit it for rogue admin accounts and tasks. Remove ManagedITSync and reinstall only the current ConnectWise-patched version, or drop the integration. CISA's required action: the product is end-of-life, so disconnect it if still in use (KEV added 2022-05-24, due 2022-06-14). No fixed version number is published in the sources I read.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-18362
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2017-18362
- 2026-10-23T21:16:22+00:00 analyst — Read NVD with the CISA KEV entry and the Huntress writeup. Kaseya's own advisory (helpdesk article 360022495572) is dead and I could not fetch it. No vendor EOL notice or fixed version found. Public PoC is kbni/owlky. Severity left critical (CVSS 3.1 9.8, exploited, KEV).
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2017-18362

## Documents

- [advisory] NVD CVE-2017-18362 (incl. CISA KEV entry) https://nvd.nist.gov/vuln/detail/CVE-2017-18362
- [mitigation] Huntress: Arbitrary SQL Execution in ManagedITSync Integration https://www.huntress.com/blog/cve-2017-18362-arbitrary-sql-injection-in-mangeditsync-integration-ba142ff24f4d
- [poc] kbni/owlky PoC for ManagedITSync https://github.com/kbni/owlky

## From the sources

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_