Remote Code Execution in Kaseya VSA (CVE‑2018‑20753) Enables Unprivileged Attackers to Execute PowerShell on Managed Devices
What It Is — A critical remote‑code‑execution flaw (CVE‑2018‑20753) in Kaseya’s Virtual System/Server Administrator (VSA) RMM platform allows an unauthenticated attacker to run arbitrary PowerShell commands on every device managed by the compromised VSA instance.
Exploitability — Publicly disclosed; proof‑of‑concept code exists. The CVSS v3.1 base score is 9.8 (Critical).
Affected Products — Kaseya Virtual System/Server Administrator (VSA) versions prior to the vendor‑issued patch (released March 2018).
Why It Matters for Trust & Control Assurance
- Third‑party software hygiene – Continuous monitoring of vendor‑supplied patches is a core control that demonstrates due‑diligence to auditors and enterprise buyers.
- Remote execution governance – Controls around privileged remote commands (e.g., PowerShell) must be logged and reviewed to provide a defensible audit trail.
- Supply‑chain risk visibility – Evidence that your RMM provider’s security posture is regularly validated satisfies multiple framework objectives (e.g., NIST CSF Identify and Protect functions).
Recommended Actions
- Verify your VSA version against the advisory and apply the March 2018 security update immediately.
- Update your asset inventory to flag all endpoints managed by VSA and enforce strict PowerShell logging.
- Incorporate the patch‑management event into your continuous control‑monitoring platform to retain evidence of remediation.
- Review and tighten remote‑execution policies (least‑privilege, MFA for admin consoles).
Source: CISA KEV – CVE‑2018‑20753