CVE-2018-6328

9.8 criticalEPSS 64%

Critical (9.8) in kaseya unitrends backup. EPSS 64% chance of exploitation in the next 30 days.

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.

Severity

CVSS 3.0

9.8 critical

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 64% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2018-03-14
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

kaseya:unitrends_backup

References

https://support.unitrends.com/UnitrendsBackup/s/article/000001150
https://support.unitrends.com/UnitrendsBackup/s/article/000006002
https://www.exploit-db.com/exploits/44297/
https://www.exploit-db.com/exploits/45559/
https://support.unitrends.com/UnitrendsBackup/s/article/000001150

Check your stack JSON