How severe is CVE-2017-18362?

CVE-2017-18362 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 86.8% probability of exploitation in the next 30 days. It is listed in the CISA Known Exploited Vulnerabilities catalog.

CVE-2017-18362: Kaseya VSA SQL Injection Vulnerability

CISA Known Exploited Vulnerabilities

Kaseya VSA SQL Injection Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV

2022-05-24

Remediation due

2022-06-14

Ransomware

Known use

Required action
The impacted product is end-of-life and should be disconnected if still in use.

CISA notes
https://nvd.nist.gov/vuln/detail/CVE-2017-18362

Description

ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and execute ransomware payloads on all endpoints managed by the VSA server. If the ManagedIT.asmx page is available via the Kaseya VSA web interface, anyone with access to the page is able to run arbitrary SQL queries, both read and write, without authentication.

Severity

CVSS 3.1 · CISA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationactive

Automatableyes

Technical impacttotal

Exploitation Context

as of October 14, 2026

All KEV statistics→

CISA added CVE-2017-18362 to the KEV catalog 1,204 days after its CVE record was published.
It is one of 3 Kaseya entries in the CISA KEV catalog, and one of 2 added in 2022.
Its current EPSS score (86.8%) is higher than that of 69% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
-	-	n/a

References

3 Links

Other references

Record Details

Published

2019-02-05

Last updated

2026-08-13

Assigner (CNA)

mitre

Credited to

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.