CVE-2018-6328: Kaseya Unitrends Backup

Critical severity, CVSS 9.8. EPSS: 64.4% chance of exploitation in the next 30 days.

It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.

Affected products

• Kaseya Unitrends Backup: before 10.1 (fixed in 10.1)

Published 2018-03-14. Last modified 2026-06-17.