26 exploited flaws in 7 self-hosted RMM servers: on-prem means you patch them
CISA's exploited-vulnerability list, counted for the remote-management servers companies run themselves, and what the cloud editions did instead, to 30 September 2026.
Running your own RMM server buys you control of where the data sits, and it hands you a patch duty that attackers watch closely. Up to 30 September 2026, CISA’s catalogue of vulnerabilities known to be exploited held 26 entries in seven remote-monitoring, endpoint-management and remote-support products that customers host themselves; nine are marked as used in ransomware campaigns.1 The 2024 version of this piece weighed cloud against on-premises RMM as a list of pros and cons. The question that decides it is narrower: when the fix ships, who installs it on the server that can reach every device you own?
01The server is the target
An RMM server holds an agent on every laptop and server in the estate, with the right to run scripts on them. Compromise it once and the attacker inherits that right. Kaseya’s July 2021 incident is the case on record: the company said fewer than 60 of its customers were directly compromised, “all of whom were using the VSA on-premises product”, with fewer than 1,500 downstream businesses hit, and that it had found no evidence any SaaS customer was compromised.2 When ConnectWise disclosed a critical ScreenConnect flaw in February 2024, its bulletin told cloud partners there was nothing to do because their servers “have been updated”; self-hosted partners had to upgrade to 23.9.8 “immediately”.3 In June 2025 CISA reported ransomware actors using unpatched SimpleHelp RMM servers, version 5.5.7 and earlier, to reach the customers of a utility billing software provider.4
Five of seven self-hosted remote-management products had an exploited flaw added to CISA's list in 2026
Entries in CISA's Known Exploited Vulnerabilities catalogue by product, added November 2021 to 30 September 2026
- Added in 2026
- Added before 2026
Table view
| Added in 2026 | Added before 2026 | |
|---|---|---|
| N-able N-central | 3 | 2 |
| Ivanti Endpoint Manager | 1 | 4 |
| ConnectWise ScreenConnect | 2 | 2 |
| SimpleHelp | 3 | 1 |
| BeyondTrust Remote Support | 1 | 2 |
| Kaseya VSA | 0 | 3 |
| ManageEngine Desktop Central | 0 | 2 |
Source: CISA KEV catalogue (JSON feed), TechBag count · as of 30 September 2026 · Kaseya VSA last had an entry added in 2022, ManageEngine Desktop Central in 2021
02The cloud moves the duty; it does not remove the risk
The evidence against moving is real. On 28 May 2025 ConnectWise said it had found suspicious activity in its own environment, which it tied to “a sophisticated nation state actor”, and that it “affected a very small number of ScreenConnect customers”.5 A cloud RMM concentrates every tenant behind one vendor’s controls. What it changes is who is on call: the vendor patches its service the night the fix exists, and a customer who never logs in to apply it is not left exposed.
03If the data must stay in India
In TechBag’s RMM and patch guide, the situation “Regulated — on-prem or India data residency is mandatory” shortlists three products. ManageEngine Endpoint Central is the only one with both an on-premises edition and an India data centre; N-able N-central and ConnectWise Automate can be self-hosted on servers you place in India. Endpoint Central’s Professional on-prem edition lists at US$795 per 50 endpoints a year.6 Under its former name, Desktop Central, it carries two of the 26 entries, both added in 2021.1 The other self-hosted routes, ConnectWise Automate and Kaseya VSA on your own server among them, are listed in our all-in-one RMM piece.7
In rupees, at the ₹83 to the dollar TechBag’s guides use, 50 endpoints of Endpoint Central Professional on-prem come to ₹65,985 a year, or ₹77,862 with 18% GST; cloud RMMs list in US dollars and are invoiced in INR through a reseller. The rules that bite run either way. CERT-In’s Directions of 28 April 2022 require incidents reported within six hours and ICT logs kept for 180 days within India, which for a self-hosted RMM means its own server logs too.8 The DPDP Rules, notified on 13 November 2025, bring the security-safeguard duty into force on 13 May 2027.9 Banks have the RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026 on top.10
Sources
- CISA, Known Exploited Vulnerabilities catalogue (JSON feed); entries added to 30 September 2026, TechBag count — entries dated November 2021 to 30 September 2026
- Kaseya, Important Notice July 2nd, 2021 (incident updates) — updates of 5 and 6 July 2021
- ConnectWise, ScreenConnect 23.9.8 security bulletin — 19 February 2024, updated 27 February 2024
- CISA, AA25-163A: Ransomware actors exploit unpatched SimpleHelp RMM to compromise a utility billing software provider — 12 June 2025
- ConnectWise, May 28, 2025 Security Event Advisory — 28 May 2025
- TechBag, RMM & Patch decision guide (situation s8: ManageEngine Endpoint Central, N-central and ConnectWise Automate; Endpoint Central Professional on-prem, US$795 per 50 endpoints a year) — undated page
- TechBag blog, One platform or three? All-in-one RMM is 1.5–4.8× cheaper on list; the catch is depth — published 10 March 2025, facts as of 30 September 2026
- CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs in India) — 28 April 2022
- MeitY, Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E)) — 13 November 2025
- RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary — 31 July 2026 RBI PDF not fetched.
Disclosure. TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.
Keep reading
