CVE-2017-18362

A Kaseya VSA SQL injection vulnerability allowed unauthenticated remote access to the database, linked to ransomware attacks.

The Kaseya VSA's ConnectWise ManagedITSync integration contained a SQL injection vulnerability enabling unauthorized access to the database. This poses a significant risk to DIB organizations using Kaseya VSA, potentially leading to data breaches and compliance failures (CMMC DF, MP). Immediately verify patch status and review access controls.

Shame score — The unauthenticated nature of the vulnerability and its exploitation by ransomware groups demonstrates a severe negligence in secure coding practices.