How severe is CVE-2014-2926?

CVE-2014-2926 has a CVSS 2.0 base score of 1.7, rated low severity.

Is CVE-2014-2926 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (25th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2014-2926?

CVE-2014-2926 primarily affects Kaseya Virtual System Administrator. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2014-2926?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2014-2926 published?

CVE-2014-2926 was published on 2014-07-14 and last updated on 2026-06-17.

CVE-2014-2926

CVE-2014-2926 is a low-severity vulnerability in Kaseya Virtual System Administrator with a CVSS 2.0 base score of 1.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Low (CVSS 2.0 base score 1.7)
EPSS exploit prediction: 0% (25th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Kaseya Virtual System Administrator
Published: 2014-07-14
Last modified: 2026-06-17

Description

kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.

Frequently asked questions

What is CVE-2014-2926?: kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows local users to cause a denial of service (NULL pointer dereference and application crash) via unspecified vectors.
How severe is CVE-2014-2926?: CVE-2014-2926 has a CVSS 2.0 base score of 1.7, rated low severity.
Is CVE-2014-2926 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (25th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2014-2926?: CVE-2014-2926 primarily affects Kaseya Virtual System Administrator. In total, 2 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2014-2926?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2014-2926 published?: CVE-2014-2926 was published on 2014-07-14 and last updated on 2026-06-17.

References

http://www.kb.cert.org/vuls/id/204988

Affected products (2)

cpe:2.3:a:kaseya:virtual_system_administrator:6.5:*:*:*:*:*:*:*
cpe:2.3:a:kaseya:virtual_system_administrator:7.0:*:*:*:*:*:*:*

More vulnerabilities in Kaseya Virtual System Administrator

CVE-2015-6922 — Critical (CVSS 9.8): Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before…
CVE-2018-20753 — Critical (CVSS 9.8): Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers…
CVE-2015-6589 — High (CVSS 8.8): Directory traversal vulnerability in Kaseya Virtual System Administrator (VSA) 7.0.0.0 before 7.0.0.33, 8..0.0.0 before…
CVE-2019-15506 — High (CVSS 7.5): An issue was discovered in Kaseya Virtual System Administrator (VSA) through 9.4.0.37. It has a critical information…
CVE-2017-12410 — High (CVSS 7.4): It is possible to exploit a Time of Check & Time of Use (TOCTOU) vulnerability by winning a race condition when Kaseya…
CVE-2015-2863 — Medium (CVSS 4.3): Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0…

All CVEs affecting Kaseya Virtual System Administrator →