CVE-2014-2926: kapfa.sys in Kaseya Virtual System Administrator (VSA) 6.5 before 6.5.0.17 and 7.0 before 7.0.0.16 allows l...

Security readout for executives and security teams

CVE-2014-2926 is a local denial-of-service issue in Kaseya VSA's kapfa.sys driver. A local user on an affected system can trigger a crash through unspecified vectors. The main business risk is disruption to a management platform, not confirmed data theft or remote compromise based on the provided sources. Exposure is most likely on systems running the affected Kaseya VSA versions with local user access. Internet exposure alone is not enough evidence here because the described attacker position is local. Organizations no longer running those versions are unlikely to be directly exposed to this specific issue. Address during normal vulnerability remediation unless the affected VSA server is business-critical or shared with untrusted local users. Escalate if vulnerable versions remain on production management infrastructure, because a local crash can disrupt administrative operations. Mitigation focus: Upgrade Kaseya VSA 6.5 to 6.5.0.17 or later where applicable.; Upgrade Kaseya VSA 7.0 to 7.0.0.16 or later where applicable.; Check current Kaseya vendor guidance for supported upgrade paths..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.