Loading vulnerability…
CVE-2021-30116 is a credential-disclosure and business-logic vulnerability affecting Kaseya VSA before version 9.5.7. The default on-premises client download page allows an unauthenticated attacker to obtain a Windows agent installer. Installing the agent generates a configuration containing an agent identifier and password. These credentials can be submitted to the download page to obtain a session cookie accepted by services not intended for agent access, bypassing intended authentication boundaries and enabling further semi-authenticated attacks. The vulnerability was exploited in July 2021 during the REvil ransomware campaign.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical unauthenticated credential disclosure and business logic flaw in Kaseya VSA that can leak agent credentials and allow attackers to obtain a sessionId cookie for semi-authenticated follow-on attacks, enabling authentication bypass against affected systems.
A critical unauthenticated credential disclosure and business logic flaw in Kaseya VSA before version 9.5.7. An attacker can download and install an agent from the public dl.asp page, extract Agent_Guid and AgentPassword from KaseyaD.ini, and use those credentials to obtain a session cookie. That cookie permits access to services not intended for agents and enables further semi-authenticated attacks. The record assigns a CVSS v3.1 score of 10.0.
A Kaseya VSA vulnerability previously targeted by REvil ransomware affiliates for initial access. It is mentioned as historical background on ransomware attacks against remote management tools, rather than as a vulnerability involved in the SimpleHelp campaign.
A Kaseya VSA vulnerability referenced as previously targeted by REvil affiliates to gain initial access.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.