← Vulnerability feed

Vulnerability record · CVE-2021-40386 · published 15 April 2022

CVE-2021-40386: Kaseya unitrends backup vulnerability

Kaseya · Unitrends Backup

Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.

9.8 CVSS 3.1 Critical EPSS 1.9% · top 20.7%
9.8CVSS 3.1 base score, v2 7.5
1.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://csirt.divd.nl/cves/CVE-2021-40386/ Third Party Advisory
https://csirt.divd.nl/cves/CVE-2021-40386/ Third Party Advisory

Track CVE-2021-40386 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-43033Kaseya unitrends backup os command injection vulnerabilityAn issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary r…EPSS 6.0%9.8CVE-2021-43035Kaseya unitrends backup sql injection vulnerabilityAn issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowi…EPSS 3.3%9.8CVE-2021-43036Kaseya unitrends backup weak password requirements vulnerabilityAn issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak.EPSS 1.9%9.8CVE-2021-43042Kaseya unitrends backup classic buffer overflow vulnerabilityAn issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A buffer overflow existed in the vaultServer component. This was exploita…EPSS 2.9%9.8CVE-2021-43044Kaseya unitrends backup hard-coded credentials vulnerabilityAn issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community.EPSS 1.9%9.8CVE-2018-6328Unitrends Backup authentication bypass leads to command injectionUnitrends Backup before 10.1.0 exposes a user interface vulnerable to an authentication bypass, allowing an unauthenticated user to reach the /api/ho…EPSS 64%analysed9.8CVE-2017-12477Unitrends Backup bpserverd authentication bypass allows root command executionThe bpserverd proprietary protocol in Unitrends Backup before 10.0.0, invoked through xinetd, can have its authentication bypassed. A remote attacker…EPSS 68%analysed9.8CVE-2017-12478Unitrends Backup api/storage auth bypass leads to root command executionThe api/storage web interface in Unitrends Backup before 10.0.0 fails to validate an input parameter, allowing authentication to be bypassed. Because…EPSS 78%analysed

Source: NIST National Vulnerability Database (record CVE-2021-40386), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.