CVE-2017-18362: ConnectWise ManagedITSync for Kaseya VSA unauthenticated SQL injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable SQL injection with full database read/write, confirmed in-the-wild ransomware exploitation, CISA KEV listing, and EPSS above the 99th percentile.

What it is

The ConnectWise ManagedITSync integration for Kaseya VSA exposes the ManagedIT.asmx page, which accepts arbitrary SQL queries without authentication. Because the queries run against the Kaseya VSA database with read and write access, an unauthenticated attacker can fully compromise the VSA server and the endpoints it manages. This flaw was exploited in the wild in February 2019 to push ransomware to managed endpoints.

Impact

An attacker gains full read and write access to the Kaseya VSA database, enabling data theft, modification of managed endpoint configurations, and deployment of ransomware or other payloads to all managed endpoints.

Attack surface

Reachable over the network through the Kaseya VSA web interface if the ManagedIT.asmx page is exposed; no authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

Listed in CISA KEV with known ransomware campaign use, and an exploit reference is tagged on GitHub; EPSS 30-day probability is 0.8682 (99.7th percentile), indicating very high likelihood of exploitation activity.

What to do

• Apply the vendor fix or remove/disconnect the end-of-life ManagedITSync integration as directed by CISA; the product is end-of-life and should be disconnected if still in use.
• Block or restrict external access to the Kaseya VSA web interface, especially the ManagedIT.asmx page, until remediation is complete.
• Isolate the VSA server from managed endpoint networks and limit its outbound reach to reduce ransomware propagation.
• Audit the VSA database and managed endpoints for unauthorized changes, and rotate any credentials stored or used by the VSA server.
• Monitor for and remove any unauthorized integration or web shell components left on the VSA server.

Detection

• Search web and proxy logs for requests to ManagedIT.asmx, particularly POST requests with SQL-like payloads or unusual query parameters.
• Monitor VSA database logs for unexpected read/write queries or schema changes originating from the web tier.
• Alert on unexpected process execution or file writes on managed endpoints initiated by the VSA server, which may indicate payload deployment.
• Review VSA server logs for authentication anomalies or access from unfamiliar source IPs around the time of suspected exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.