PatchTheCVECVE-2021-30118: An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monito
CVE-2021-30118 is a critical-severity flaw (CVSS 9.8) affecting vsa. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leading to RCE. An attacker can upload files with the privilege of the Web Server process and subsequently use these files to execute asp commands. Detailed
Why this priority
- Critical severity
- EPSS top 1%: very likely to be exploited
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 60.3% (top 1%) |
| CISA exploited list | No |
| Weakness | CWE-434 |
| Published | 2021-07-09 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Public exploits and detection
Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.
- Nuclei scan template: Kaseya VSA < 9.5.7 - Arbitrary File Upload to Remote Code Execution
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-30118?
vsa: upgrade to 9.5.5. Exact commands for each OS are on this page.
Is CVE-2021-30118 being exploited?
CVE-2021-30118 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-30118 affect?
CVE-2021-30118 affects vsa. Severity is critical (CVSS 9.8). An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vu
How urgent is CVE-2021-30118?
Priority 69/100. Critical severity; EPSS top 1%: very likely to be exploited; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2021-30120 CRITICAL 9.9 UPGRADE Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement
- CVE-2021-30119 MEDIUM 5.4 UPGRADE Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp i
- CVE-2021-30201 HIGH 7.5 UPGRADE The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system
- CVE-2021-30121 MEDIUM 6.5 UPGRADE Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Examp
- CVE-2021-30117 CRITICAL 9.8 UPGRADE The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injectio