PatchTheCVECVE-2021-30120: Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement
CVE-2021-30120 is a critical-severity flaw (CVSS 9.9) affecting vsa. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFARequired and MFAEnroled. If the attacker has obtained
Why this priority
- Critical severity
- EPSS top 7%: very likely to be exploited
A fixed release or distro patch exists.
Risk facts
| CVSS score | 9.9 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 5.7% (top 7%) |
| CISA exploited list | No |
| Weakness | CWE-669 |
| Published | 2021-07-09 |
| Last modified | 2026-08-14 |
Last updated 2026-08-14 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2021-30120?
vsa: upgrade to newer than 9.5.6. Exact commands for each OS are on this page.
Is CVE-2021-30120 being exploited?
CVE-2021-30120 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2021-30120 affect?
CVE-2021-30120 affects vsa. Severity is critical (CVSS 9.9). Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed descr
How urgent is CVE-2021-30120?
Priority 58/100. Critical severity; EPSS top 7%: very likely to be exploited
Related CVEs
- CVE-2021-30119 MEDIUM 5.4 UPGRADE Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp i
- CVE-2021-30201 HIGH 7.5 UPGRADE The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system
- CVE-2021-30121 MEDIUM 6.5 UPGRADE Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Examp
- CVE-2021-30118 CRITICAL 9.8 UPGRADE An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monito
- CVE-2021-30117 CRITICAL 9.8 UPGRADE The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injectio