- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 36
- Public CVEs
- 35
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this Program will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
36 assets you may test, 2 excluded.
Wildcard domains 34
- *.365command.com Critical No bounty
- *.auditforit.com Critical No bounty
- *.autotask.net Critical No bounty
- *.backupify.com Critical No bounty
- *.backup.net Critical No bounty
- *.bitdam.com Critical No bounty
- *.centrastage.net Critical No bounty
- *.cloudtrax.com Critical No bounty
- *.connectit.com Critical No bounty
- *.dattobackup.com Critical No bounty
- *.datto.com Critical No bounty
- *.gluh.co Critical No bounty
- *.graphus.ai Critical No bounty
- *.idagent.com Critical No bounty
- *.infocyte.com Critical No bounty
- *.inky.com Critical No bounty
- *.itglue.com Critical No bounty
- *.kaseyacloud.com Critical No bounty
- *.kaseya.com Critical No bounty
- *.kaseya.net Critical No bounty
- *.liveconnect.me Critical No bounty
- *.openmesh.com Critical No bounty
- *.pulseway.com Critical No bounty
- *.rapidfiretools.com Critical No bounty
- *.rocketcyber.com Critical No bounty
- *.scorpionsoft.com Critical No bounty
- *.soonr.com Critical No bounty
- *.spanningbackup.com Critical No bounty
- *.spanning.com Critical No bounty
- *.trumethods.com Critical No bounty
- *.unigma.com Critical No bounty
- *.unitrends.com Critical No bounty
- *.unitrendsmsp.com Critical No bounty
- *.vorexlogin.com Critical No bounty
Web 2
- autotask.net Critical No bounty
- https://qa.manage.saasalerts.com Critical No bounty
Out of scope (2)
- *.authanvil.com
- *.passly.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Kaseya (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please provide detailed reports with reproducible steps.
-
Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g., phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
-
Only interact with accounts you own or with explicit permission of the account holder.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 56 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
https://qa.manage.saasalerts.com/
-
Scope removed
*.saasalerts.com
-
Scope added
*.inky.com
-
Scope added
*.authanvil.com (out of scope)
-
Scope added
*.passly.com (out of scope)
-
Scope added
*.365command.com
-
Scope added
*.auditforit.com
-
Scope added
*.autotask.net
-
Scope added
*.backup.net
-
Scope added
*.backupify.com
-
Scope added
*.bitdam.com
-
Scope added
*.centrastage.net
-
Scope added
*.cloudtrax.com
-
Scope added
*.connectit.com
-
Scope added
*.datto.com
-
Scope added
*.dattobackup.com
-
Scope added
*.gluh.co
-
Scope added
*.graphus.ai
-
Scope added
*.idagent.com
-
Scope added
*.infocyte.com
-
Scope added
*.itglue.com
-
Scope added
*.kaseya.com
-
Scope added
*.kaseya.net
-
Scope added
*.kaseyacloud.com
-
Scope added
*.liveconnect.me
-
Scope added
*.openmesh.com
-
Scope added
*.pulseway.com
-
Scope added
*.rapidfiretools.com
-
Scope added
*.rocketcyber.com
-
Scope added
*.scorpionsoft.com
-
Scope added
*.soonr.com
-
Scope added
*.spanning.com
-
Scope added
*.spanningbackup.com
-
Scope added
*.trumethods.com
-
Scope added
*.unigma.com
-
Scope added
*.unitrends.com
-
Scope added
*.unitrendsmsp.com
-
Scope added
*.vorexlogin.com
-
Scope added
autotask.net
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2021-40386 | Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code. | Critical 9.8 | 15 Apr 2022 |
| CVE-2021-43041 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application. | High 8.8 | 6 Dec 2021 |
| CVE-2021-43042 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A buffer overflow existed in the vaultServer component. This was exploitable by a remote unauthenticated attacker. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43043 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule. | Medium 6.5 | 6 Dec 2021 |
| CVE-2021-43044 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43033 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input (received by the server) being passed to system calls. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43034 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apache, leading to privilege escalation. | High 7.8 | 6 Dec 2021 |
| CVE-2021-43035 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full access to the postgres user account. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43036 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43037 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Unitrends Windows agent was vulnerable to DLL injection and binary planting due to insecure default permissions. This allowed privilege escalation from an unprivileged user to SYSTEM. | High 7.8 | 6 Dec 2021 |
| CVE-2021-43038 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The wguest account could execute commands by injecting into PostgreSQL trigger functions. This allowed privilege escalation from the wguest user to the postgres user. | High 8.8 | 6 Dec 2021 |
| CVE-2021-43039 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Samba file sharing service allowed anonymous read/write access. | Medium 6.5 | 6 Dec 2021 |
| CVE-2021-43040 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The privileged vaultServer could be leveraged to create arbitrary writable files, leading to privilege escalation. | High 8.8 | 6 Dec 2021 |
| CVE-2021-40385 | An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privilege escalation from read-only user to admin. | High 8.8 | 1 Sep 2021 |
| CVE-2021-40387 | An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticated remote code execution. | High 8.8 | 1 Sep 2021 |
| CVE-2021-30116 | Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXX | Critical 10.0 | 9 Jul 2021 |
| CVE-2021-30117 | The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: ``` GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml, | Critical 9.8 | 9 Jul 2021 |
| CVE-2021-30118 | An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leading to RCE. An attacker can upload files with the privilege of the Web Server process and subsequently | Critical 9.8 | 9 Jul 2021 |
| CVE-2021-30119 | Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `ht | Medium 5.4 | 9 Jul 2021 |
| CVE-2021-30120 | Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFAReq | Critical 9.9 | 9 Jul 2021 |
| CVE-2021-30121 | Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118 | Medium 6.5 | 9 Jul 2021 |
| CVE-2021-30201 | The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type: text/xml;charset=UTF-8 Host: 192.168.1.194:18081 Content-Length: 406 <soapenv:Envelope xmlns:soapen | High 7.5 | 9 Jul 2021 |
| CVE-2015-6922 | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData paramete | Critical 9.8 | 17 Feb 2020 |
| CVE-2015-6589 | Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. | High 8.8 | 13 Feb 2020 |
| CVE-2019-14510 | An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client | Medium 6.7 | 11 Oct 2019 |
| CVE-2019-15506 | An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports s | High 7.5 | 26 Aug 2019 |
| CVE-2018-20753 | Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild. | Critical 9.8 | 5 Feb 2019 |
| CVE-2017-12410 | It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of arbitrary programs with "NT AUTHORITY\SYSTEM" privileges. | High 7.4 | 26 Mar 2018 |
| CVE-2018-6328 | It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes. | Critical 9.8 | 14 Mar 2018 |
| CVE-2017-12477 | It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system. | Critical 9.8 | 7 Aug 2017 |
| CVE-2017-12478 | It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system. | Critical 9.8 | 7 Aug 2017 |
| CVE-2017-12479 | It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges. | High 8.8 | 7 Aug 2017 |
| CVE-2015-2863 | Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | Medium 4.3 | 20 Jul 2015 |
| CVE-2015-2862 | Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request. | Medium 4.0 | 20 Jul 2015 |
| CVE-2014-2926 | kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. | Low 1.7 | 14 Jul 2014 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Kaseya looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
Disclosure Policy
- Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
Program Rules
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
- Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
- Social engineering (e.g., phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
- Only interact with accounts you own or with explicit permission of the account holder.
Session Layer: HTTP Headers
Researchers should add headers to requests such as:
- “X-HackerOne-Research: [H1 username]”
Legal
Non-Disclosure Agreement: All information relating to vulnerabilities that you become aware of through Kaseya’s VDP is considered confidential. In order to give Kaseya time to remediate a vulnerability, you agree to refrain from disclosing confidential information publicly or to any third party (outside of Kaseya) without prior, written approval from the Information Security team at Kaseya. You agree to honor any request from the Information Security team at Kaseya to promptly return or destroy all copies of confidential information and all notes related to the confidential information.
In honor of our commitment to collaboration and transparency, the Kaseya Information Security team will not withhold approval of disclosure unless Kaseya believes, in good faith, that confidentiality is required to avoid material harm.
You must comply with all applicable laws, rules and regulations (including those local to you) with respect to your activities related to Kaseya’s VDP. Rewards will not be issued to you if you are (a) in an US embargoed country or (b) on a US Government list of sanctioned or restricted individuals or affiliated with any sanctioned or restricted entities.
Kaseya reserves the right to modify the terms and conditions of this VDP and your participation in the Program constitutes acceptance of all terms. Please check this site regularly as we routinely update our VDP terms and eligibility, which are effective upon posting. We reserve the right to cancel this Program at any time.
Safe Harbor
Any activities conducted in a manner consistent with this Program will be considered authorized conduct and we will not initiate legal action against you.
When conducting vulnerability research under this Policy, we consider this research to be:
- Authorized concerning any applicable anti-hacking laws, and we will not initiate or support legal action against you for accidental, good-faith violations of this Policy.
- Authorized concerning any relevant anti-circumvention laws, and we will not bring a claim against you for circumvention of technology controls.
- Exempt from restrictions in our Terms of Service (TOS) and/or Acceptable Usage Policy (AUP) that would interfere with conducting security research, and we waive those restrictions on a limited basis.
- Lawful, helpful to the overall security of the Internet, and conducted in good faith.
You are expected, as always, to comply with all applicable laws. If at any time you have concerns or are uncertain whether your security research is consistent with this Policy, please submit a report through one of our Official Channels before going any further.
Thank you for helping keep Kaseya and our users safe!