Kayesa
By Kaseya Bug bounty on Self-hosted kaseya.com
Accepting reports
Full safe harbor
KYC to get paid
- Top reward
- $10,101
- Top severity paid
- Not published
- Assets in scope
- 68
- Public CVEs
- 35
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $10,101
- top reward, from $101.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 3 days
- As the policy promises.
- Payment
- Proof of identity needed to get paid.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$10,101
Rewards for qualifying findings will range from $101, to $10,101 in appreciation of your help protecting business critical ones and zeros.
- Lowest reward
-
$101
Rewards for qualifying findings will range from $101, to $10,101 in appreciation of your help protecting business critical ones and zeros.
- Response
-
Within 3 days
Strive to fully triage reports within 3 business days.
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this Program will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
68 assets you may test, 7 excluded.
Domains 33
- 365command.com
- authanvil.com
- autotask.net
- backupify.com
- backup.net
- bitdam.com
- centrastage.net
- cloudtrax.com
- connectit.com
- dattobackup.com
- gluh.co
- graphus.ai
- idagent.com
- infocyte.com
- itglue.com
- kaseyacloud.com
- kaseya.com
- kaseya.net
- liveconnect.me
- openmesh.com
- passly.com
- rapidfiretools.com
- rocketcyber.com
- scorpionsoft.com
- soonr.com
- spanningbackup.com
- spanning.com
- traverse-monitoring.com
- trumethods.com
- unigma.com
- unitrends.com
- unitrendsmsp.com
- vorexlogin.com
Wildcard domains 33
- *.365command.com
- *.authanvil.com
- *.autotask.net
- *.backupify.com
- *.backup.net
- *.bitdam.com
- *.centrastage.net
- *.cloudtrax.com
- *.connectit.com
- *.dattobackup.com
- *.gluh.co
- *.graphus.ai
- *.idagent.com
- *.infocyte.com
- *.itglue.com
- *.kaseyacloud.com
- *.kaseya.com
- *.kaseya.net
- *.liveconnect.me
- *.openmesh.com
- *.passly.com
- *.rapidfiretools.com
- *.rocketcyber.com
- *.scorpionsoft.com
- *.soonr.com
- *.spanningbackup.com
- *.spanning.com
- *.traverse-monitoring.com
- *.trumethods.com
- *.unigma.com
- *.unitrends.com
- *.unitrendsmsp.com
- *.vorexlogin.com
Hardware and IoT 1
- Kaseya-branded hardware devices
Products and areas 1
- Kaseya-developed mobile apps
Out of scope (7)
- cpkg.datto.com
- investors.datto.com
- mirror.datto.com
- swag.datto.com
- tools.datto.com
- zfs.datto.com
- Third-party websites: Domains registered to Kaseya but hosted by a third party.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Kayesa's policy. "We" in these lines means the program, not this site.
While testing
-
Operate in good faith.
-
Notify us as soon as possible once you discover a real or potential security issue.
-
Do not discuss vulnerabilities outside of the VDP without express consent from Kaseya.
-
Do not perform denial of service attacks, or any attacks that have a reasonable chance of degrading Kaseya’s service or customer experience.
-
Do not intentionally view, store, modify, or destroy data that does not belong to you.
-
Only interact with test accounts that you own or accounts that you have explicit permission from the account holder to use.
-
Not engage in extortion or other harmful behavior.
-
Do not upload screenshots, videos, or exploit code to a publicly accessible server/repository in preparation of your email.
-
Do not zip or archive your files (just attach them directly to the email).
Not accepted
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability.
-
Content spoofing and/or text injection issues without showing an attack vector.
-
Clickjacking on pages with no sensitive actions.
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions.
-
Denial of Service (DoS).
-
Issues that require unlikely user interaction by the victim.
-
Missing best practices in Content Security Policy.
-
Missing best practices in SSL/TLS configuration.
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.).
-
Rate limiting or brute-force issues on non-authentication endpoints.
-
Software version disclosure / Banner identification issues.
-
Output from Automated Scanners without a PoC to demonstrate a specific vulnerability.
-
Previously known vulnerable libraries without a working Proof of Concept.
-
Vulnerabilities that only affect users of outdated or unpatched browsers.
-
Attacks requiring MITM or physical access to a user’s device.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2021-40386 | Kaseya Unitrends Client/Agent through 10.5,5 allows remote attackers to execute arbitrary code. | Critical 9.8 | 15 Apr 2022 |
| CVE-2021-43041 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A crafted HTTP request could induce a format string vulnerability in the privileged vaultServer application. | High 8.8 | 6 Dec 2021 |
| CVE-2021-43042 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A buffer overflow existed in the vaultServer component. This was exploitable by a remote unauthenticated attacker. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43043 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule. | Medium 6.5 | 6 Dec 2021 |
| CVE-2021-43044 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The SNMP daemon was configured with a weak default community. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43033 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input (received by the server) being passed to system calls. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43034 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. A world writable file allowed local users to execute arbitrary code as the user apache, leading to privilege escalation. | High 7.8 | 6 Dec 2021 |
| CVE-2021-43035 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. Two unauthenticated SQL injection vulnerabilities were discovered, allowing arbitrary SQL queries to be injected and executed under the postgres superuser account. Remote code execution was possible, leading to full access to the postgres user account. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43036 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The password for the PostgreSQL wguest account is weak. | Critical 9.8 | 6 Dec 2021 |
| CVE-2021-43037 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Unitrends Windows agent was vulnerable to DLL injection and binary planting due to insecure default permissions. This allowed privilege escalation from an unprivileged user to SYSTEM. | High 7.8 | 6 Dec 2021 |
| CVE-2021-43038 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The wguest account could execute commands by injecting into PostgreSQL trigger functions. This allowed privilege escalation from the wguest user to the postgres user. | High 8.8 | 6 Dec 2021 |
| CVE-2021-43039 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Samba file sharing service allowed anonymous read/write access. | Medium 6.5 | 6 Dec 2021 |
| CVE-2021-43040 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The privileged vaultServer could be leveraged to create arbitrary writable files, leading to privilege escalation. | High 8.8 | 6 Dec 2021 |
| CVE-2021-40385 | An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is a privilege escalation from read-only user to admin. | High 8.8 | 1 Sep 2021 |
| CVE-2021-40387 | An issue was discovered in the server software in Kaseya Unitrends Backup Software before 10.5.5-2. There is authenticated remote code execution. | High 8.8 | 1 Sep 2021 |
| CVE-2021-30116 | Kaseya VSA before 9.5.7 allows credential disclosure, as exploited in the wild in July 2021. By default Kaseya VSA on premise offers a download page where the clients for the installation can be downloaded. The default URL for this page is https://x.x.x.x/dl.asp When an attacker download a client for Windows and installs it, the file KaseyaD.ini is generated (C:\Program Files (x86)\Kaseya\XXXXXXXX | Critical 10.0 | 9 Jul 2021 |
| CVE-2021-30117 | The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. Detailed description --- Given the following request: ``` GET /InstallTab/exportFldr.asp?fldrId=1’ HTTP/1.1 Host: 192.168.1.194 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.16; rv:85.0) Gecko/20100101 Firefox/85.0 Accept: text/html,application/xhtml+xml, | Critical 9.8 | 9 Jul 2021 |
| CVE-2021-30118 | An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated arbitrary file upload leading to RCE. An attacker can upload files with the privilege of the Web Server process and subsequently | Critical 9.8 | 9 Jul 2021 |
| CVE-2021-30119 | Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request: `https://x.x.x.x/HelpDeskTab/rcResults.asp?result=<script>alert(document.cookie)</script>` The same is true for the parameter FileName of /done.asp Eaxmple request: `ht | Medium 5.4 | 9 Jul 2021 |
| CVE-2021-30120 | Kaseya VSA before 9.5.7 allows attackers to bypass the 2FA requirement. The need to use 2FA for authentication in enforce client-side instead of server-side and can be bypassed using a local proxy. Thus rendering 2FA useless. Detailed description --- During the login process, after the user authenticates with username and password, the server sends a response to the client with the booleans MFAReq | Critical 9.9 | 9 Jul 2021 |
| CVE-2021-30121 | Semi-authenticated local file inclusion The contents of arbitrary files can be returned by the webserver Example request: `https://x.x.x.x/KLC/js/Kaseya.SB.JS/js.aspx?path=C:\Kaseya\WebPages\dl.asp` A valid sessionId is required but can be easily obtained via CVE-2021-30118 | Medium 6.5 | 9 Jul 2021 |
| CVE-2021-30201 | The API /vsaWS/KaseyaWS.asmx can be used to submit XML to the system. When this XML is processed (external) entities are insecurely processed and fetched by the system and returned to the attacker. Detailed description Given the following request: ``` POST /vsaWS/KaseyaWS.asmx HTTP/1.1 Content-Type: text/xml;charset=UTF-8 Host: 192.168.1.194:18081 Content-Length: 406 <soapenv:Envelope xmlns:soapen | High 7.5 | 9 Jul 2021 |
| CVE-2015-6922 | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly require authentication, which allows remote attackers to bypass authentication and (1) add an administrative account via crafted request to LocalAuth/setAccount.aspx or (2) write to and execute arbitrary files via a full pathname in the PathData paramete | Critical 9.8 | 17 Feb 2020 |
| CVE-2015-6589 | Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before 8.0.0.23, 9.0.0.0 before 9.0.0.19, and 9.1.0.0 before 9.1.0.9 allows remote authenticated users to write to and execute arbitrary files due to insufficient restrictions in file paths to json.ashx. | High 8.8 | 13 Feb 2020 |
| CVE-2019-14510 | An issue was discovered in Kaseya VSA RMM through 9.5.0.22. When using the default configuration, the LAN Cache feature creates a local account FSAdminxxxxxxxxx (e.g., FSAdmin123456789) on the server that hosts the LAN Cache and all clients that are assigned to a LAN Cache. This account is placed into the local Administrators group of all clients assigned to the LAN Cache. When the assigned client | Medium 6.7 | 11 Oct 2019 |
| CVE-2019-15506 | An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information disclosure vulnerability. An unauthenticated attacker can send properly formatted requests to the web application and download sensitive files and information. For example, the /DATAREPORTS directory can be farmed for reports. Because this directory contains the results of reports s | High 7.5 | 26 Aug 2019 |
| CVE-2018-20753 | Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads on all managed devices. In January 2018, attackers actively exploited this vulnerability in the wild. | Critical 9.8 | 5 Feb 2019 |
| CVE-2017-12410 | It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of arbitrary programs with "NT AUTHORITY\SYSTEM" privileges. | High 7.4 | 26 Mar 2018 |
| CVE-2018-6328 | It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes. | Critical 9.8 | 14 Mar 2018 |
| CVE-2017-12477 | It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed. A remote attacker could use this issue to execute arbitrary commands with root privilege on the target system. | Critical 9.8 | 7 Aug 2017 |
| CVE-2017-12478 | It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated. A remote attacker could use this flaw to bypass authentication and execute arbitrary commands with root privilege on the target system. | Critical 9.8 | 7 Aug 2017 |
| CVE-2017-12479 | It was discovered that an issue in the session logic in Unitrends Backup (UB) before 10.0.0 allowed using the LOGDIR environment variable during a web session to elevate an existing low-privilege user to root privileges. A remote attacker with existing low-privilege credentials could then execute arbitrary commands with root privileges. | High 8.8 | 7 Aug 2017 |
| CVE-2015-2863 | Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | Medium 4.3 | 20 Jul 2015 |
| CVE-2015-2862 | Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 before 9.0.0.14, and 9.1 before 9.1.0.4 allows remote authenticated users to read arbitrary files via a crafted HTTP request. | Medium 4.0 | 20 Jul 2015 |
| CVE-2014-2926 | kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors. | Low 1.7 | 14 Jul 2014 |