Puzzle Technology
← All incidents

PHP vulnerabilities (CVE-2026-109618 and CVE-2026-109619): Kaseya status - Investigation and Remediation

Minor · identified · started 21 Oct 2026, 22:51

Datto

  1. identified · 30 Oct 2026, 17:10

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS/Vorex - Fully patched ConnectBooster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Fully Patched Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Fully Patched Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Fully Patched RocketCyber - Fully Patched SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 On Prem - Unaffected VSA 10 Cloud - Fully Patched VSA 9 On Prem - Unaffected VSA 9 Cloud - Fully Patched We will continue to provide updates as additional information becomes available. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

  2. identified · 29 Oct 2026, 19:06

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS - Fully patched ConnectBooster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Fully Patched Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Fully Patched Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Fully Patched RocketCyber - Fully Patched SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 On Prem - Unaffected VSA 10 Cloud - Fully Patched VSA 9 On Prem - Unaffected VSA 9 Cloud - Fully Patched We will continue to provide updates as additional information becomes available. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

  3. identified · 29 Oct 2026, 09:32

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS - Fully patched ConnectBooster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Fully Patched Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Fully Patched Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Fully Patched RocketCyber - Fully Patched SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 On Prem - Unaffected VSA 9 Cloud - Compensating Controls We will continue to provide updates as additional information becomes available. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

  4. resolved · 29 Oct 2026, 09:31

    Closed by an administrator.

  5. identified · 28 Oct 2026, 19:23

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS - Fully patched ConnectBooster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Fully Patched Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Fully Patched Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Fully Patched RocketCyber - Fully Patched SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 On Prem - Unaffected VSA 9 Cloud - Compensating Controls We will continue to provide updates as additional information becomes available. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

  6. identified · 28 Oct 2026, 18:45

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS - Fully patched Connect Booster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Compensating Controls Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Compensating Controls Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Fully Patched RocketCyber - Compensating Controls SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 - Compensating Controls We will continue to provide updates as additional information becomes available. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

  7. identified · 27 Oct 2026, 19:04

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS - Fully patched Connect Booster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Fully Patched Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Compensating Controls Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Fully Patched RocketCyber - Compensating Controls SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 - Compensating Controls We will continue to provide updates as additional information becomes available. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

  8. identified · 26 Oct 2026, 21:28

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS - Fully patched Connect Booster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Fully Patched Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Compensating Controls Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Compensating Controls RocketCyber - Compensating Controls SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 - Compensating Controls We will continue to provide updates as additional information becomes available. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

  9. identified · 26 Oct 2026, 20:12

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS - Fully patched Connect Booster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Compensating Controls Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Compensating Controls Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Compensating Controls RocketCyber - Compensating Controls SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 - Compensating Controls We will continue to provide updates as additional information becomes available. For additional questions, please create a ticket with our Support team here: https://helpdesk.kaseya.com/hc/en-gb#/contact

  10. identified · 26 Oct 2026, 18:56

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Fully Patched Datto Backup for Azure Files + Blob Storage - Unaffected BMS - Fully patched Connect Booster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Fully Patched Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Compensating Controls Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Compensating Controls Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Compensating Controls RocketCyber - Compensating Controls SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 - Compensating Controls We will continue to provide updates as additional information becomes available. Please contact your account manager with questions.

  11. identified · 23 Oct 2026, 21:22

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none **2026-10-23T20:20:50.686Z** — Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Compensating Controls Azure - Files - Unaffected BMS - Fully patched Connect Booster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Compensating Controls Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Compensating Controls Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Compensating Controls Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Compensating Controls RocketCyber - Compensating Controls SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 - Compensating Controls We will continue to provide updates as additional information becomes available. Please contact your account manager with questions.

  12. investigating · 23 Oct 2026, 10:16

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none

  13. resolved · 23 Oct 2026, 10:15

    Closed by an administrator.

  14. investigating · 22 Oct 2026, 14:30

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities were disclosed in third-party PHP libraries that allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none

  15. investigating · 21 Oct 2026, 22:53

    **2026-10-21T21:51:35.239Z** — Two critical vulnerabilities in PHP allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none