ConnectWise ManagedITSync - SQLi (CVE-2017-18362)

CVE-2017-18362 is a critical vulnerability in the ConnectWise ManagedITSync integration for Kaseya VSA, allowing unauthenticated attackers to execute arbitrary SQL commands and gain full access to the VSA database remotely. This flaw has been actively exploited in the wild, enabling threat actors to deploy ransomware across all endpoints managed by the affected VSA server. Attackers can leverage this vulnerability to read, modify, or destroy sensitive data, posing a severe risk to organizations using vulnerable versions.

CrowdSec has been tracking this vulnerability and its exploits since 29th of October 2025.

CrowdSec network data shows that most actors exploiting CVE-2017-18362 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2017-18362 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2017-18362 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit this vulnerability by sending requests to the /KaseyaCwWebService/ManagedIT.asmx endpoint, often looking for operations like ExecuteSQLQuery to run arbitrary SQL commands without authentication.