---
id: "CVE-2021-30116"
kind: "vulnerability"
aliases: ["CVE-2021-30116"]
title: "Kaseya Virtual System/Server Administrator (VSA): Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability"
severity: "critical"
cvss: 10.0
epss: 0.85735
exploited: true
status: "open"
category: "vendor"
products: [{"name": "Kaseya Virtual System/Server Administrator (VSA)", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "kaseya-vsa", "msp", "on-premise", "ransomware", "vendor"]
not_affected_if: ["managed-hosting", "no-vsa-deployment"]
published_at: "2021-07-09T14:15:07+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30116", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-30116", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-30116", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Kaseya Virtual System/Server Administrator (VSA): Kaseya Virtual System/Server Administrator (VSA) Information Disclosure Vulnerability

Kaseya VSA, a remote monitoring and management server, leaks a session ID through an information disclosure flaw. An attacker can use that session ID to carry out further attacks on the VSA system.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Kaseya Virtual System/Server Administrator (VSA) affected ? fixed ?

## Fix

Apply the updates per Kaseya's vendor instructions; the specific fixed version is not stated in the sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30116
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-30116
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-30116

## From the sources

Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXXXX\KaseyaD.ini) which contains an Agent_Guid and AgentPassword This Agent_Guid and AgentPassword can be used to log in on dl.asp (https://x.x.x.x/dl.asp?un=840997037507813&pw=113cc622839a4077a84837485ced6b93e440bf66d44057713cb2f95e503a06d9) This request authenticates the client and returns a sessionId cookie that can be used in subsequent attacks to bypass authentication. Security issues discovered --- * Unauthenticated download page leaks credentials * Credentials of agent software can be used to obtain a sessionId (cookie) that can be used for services not intended for use by agents * dl.asp accepts credentials via a GET request * Access to KaseyaD.ini gives an attacker access to sufficient information to penetrate the Kaseya installation and its clients. Impact --- Via the page /dl.asp enough information can be obtained to give an attacker a sessionId that can be used to execute further (semi-authenticated) attacks against the system.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_