{"id":"CVE-2017-18362","published":"2019-02-05T06:29:00Z","modified":"2026-08-13T05:17:15Z","title":"Kaseya VSA SQL Injection Vulnerability","vendor":"Kaseya","product":"Virtual System/Server Administrator (VSA)","tier":"core","eol":null,"description":{"text":"ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an SQL injection in the ConnectWise ManagedITSync integration of the Kaseya Virtual System/Server Administrator (VSA) product, exposed through its ManagedIT.asmx web page. An unauthenticated attacker who can reach that page over the network, with no user interaction required, can run arbitrary read and write SQL queries against the Kaseya VSA database.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:53:44Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.8682,"percentile":0.99742,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","ransomware":true,"requiredAction":"The impacted product is end-of-life and should be disconnected if still in use.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-18362","provenance":"source"},"vulncheckKev":{"dateAdded":"2019-02-08","exploitedFirstSeen":"2019-02-08","ransomware":true,"evidence":[{"url":"https://blog.huntresslabs.com/cve-2017-18362-arbitrary-sql-injection-in-mangeditsync-integration-ba142ff24f4d","date":"2019-02-08"},{"url":"https://cybersecurity.att.com/blogs/labs-research/botenago-strike-again-malware-source-code-uploaded-to-github","date":"2022-01-26"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/ransomware-_-2022-spotlight-report_compressed.pdf","date":"2022-01-26"},{"url":"https://www.fortiguard.com/threat-signal-report/4389/botenago-malware-targets-multiple-iot-devices","date":"2022-01-27"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/RansomwareUpdate%20Report%202022%20Q1.pdf","date":"2022-04-12"},{"url":"https://cybersecurityworks.com/howdymanage/uploads/file/Spotlight%20Report%20-%20Index%20Update%20Q2%20-%20Q3%20-%20Final%20Version_compressed.pdf","date":"2022-05-18"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-24"},{"url":"https://www.ivanti.com/resources/v/doc/pr-survey-report/ransomware-quarterly-indexreport_q2-q3","date":"2022-10-21"},{"url":"https://info.securin.io/hubfs/Securin%20Ransomware%20Report%202023.pdf","date":"2023-02-14"},{"url":"https://4502402.fs1.hubspotusercontent-na1.net/hubfs/4502402/Ransomware%20-%20Index%20Update%20Q1%202023.pdf","date":"2023-05-15"}],"evidenceTotal":12,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command"}],"references":[{"url":"http://archive.today/rdkeQ","tags":["Third Party Advisory"]},{"url":"https://github.com/kbni/owlky","tags":["Exploit","Third Party Advisory"]},{"url":"https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+","tags":["Broken Link","Third Party Advisory"]},{"url":"http://archive.today/rdkeQ","tags":["Third Party Advisory"]},{"url":"https://github.com/kbni/owlky","tags":["Exploit","Third Party Advisory"]},{"url":"https://webcache.googleusercontent.com/search?q=cache:ZEo8ZRF_iEIJ:https://helpdesk.kaseya.com/hc/en-gb/articles/360022495572-Connectwise-API-Vulnerability+","tags":["Broken Link","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-18362","tags":["US Government Resource"]}],"techniques":[{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: SQL queries used to execute payloads on endpoints","mappingType":"uncategorized","evidence":[{"from":"description","quote":"attackers have actively exploited this in the wild to download and execute ransomware payloads","start":191,"end":285}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: unauthenticated remote access via public web interface","mappingType":"uncategorized","evidence":[{"from":"description","quote":"anyone with access to the page is able to run arbitrary SQL queries","start":404,"end":471}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: full read access to database contents","mappingType":"primary_impact","evidence":[{"from":"description","quote":"allow full direct access to the Kaseya VSA database","start":120,"end":171}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-9480","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-9480","exploited":true,"exploitedSince":"2022-05-24","provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2017-18362","name":"Kaseya VSA 2017 ConnectWise ManagedITSync - Remote Code Execution","severity":"critical","path":"http/cves/2017/CVE-2017-18362.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2017/CVE-2017-18362.yaml"}],"provenance":"source"},"exploitRefs":["https://github.com/kbni/owlky"],"flow":[{"stage":"primary","techniques":["T1005"],"provenance":"ai"},{"stage":"related","techniques":["T1190","T1059"],"provenance":"source"}],"timeline":[{"date":"2019-02-05","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-18362","provenance":"source"},{"date":"2019-02-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.huntresslabs.com/cve-2017-18362-arbitrary-sql-injection-in-mangeditsync-integration-ba142ff24f4d","provenance":"source"},{"date":"2022-05-24","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-24","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-9480","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":1204},"priority":{"score":79.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2820 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9974"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}