Unauthenticated SQL execution in ConnectWise ManagedITSync for Kaseya VSA

Unauthenticated attackers can read and modify the Kaseya VSA database through arbitrary SQL queries. Exploitation can extend beyond the VSA server to its managed endpoints; observed attacks downloaded and executed ransomware across all endpoints managed by the compromised server.

If immediate remediation is not possible, disable or remove access to the ManagedITSync web service endpoint from the Kaseya VSA web interface, especially from untrusted networks. Restrict access to the VSA management interface through network segmentation, VPN-only administration, IP allowlisting, and strong perimeter controls. Monitor for anomalous SQL activity and unexpected administrative actions originating through the integration path. Because exploitation has been reported in the wild, incident response review and threat hunting should be prioritized for exposed systems.

Upgrade or remove the vulnerable ConnectWise ManagedITSync integration for Kaseya VSA so that the exposed unauthenticated SQL execution condition is eliminated. If a vendor-supplied fixed version or security update is available, it should be applied immediately. The vulnerable integration endpoint should not remain deployed in production in its affected form. Review the Kaseya VSA environment for unauthorized database changes and signs of malicious use, particularly where the integration was internet-accessible or otherwise reachable by untrusted users.