---
title: "26 exploited flaws in 7 self-hosted RMM servers: on-prem means you patch them"
summary: "CISA's exploited-vulnerability list, counted for the remote-management servers companies run themselves, and what the cloud editions did instead, to 30 September 2026."
url: https://www.thetechbag.com/blog/current-rmm-landscape-cloud-based-premise-solutions
format: Note
desk: "Endpoints & devices"
published: 2026-06-02
facts_checked: 2026-09-30
author: TechBag (The TechBag Journal)
tags: ["RMM","on-premises","cloud","CISA KEV","ScreenConnect","Kaseya VSA","N-able N-central","SimpleHelp","ManageEngine Endpoint Central","data residency","CERT-In"]
cover: https://www.thetechbag.com/blog/covers/current-rmm-landscape-cloud-based-premise-solutions.png
---

# 26 exploited flaws in 7 self-hosted RMM servers: on-prem means you patch them

*CISA's exploited-vulnerability list, counted for the remote-management servers companies run themselves, and what the cloud editions did instead, to 30 September 2026.*

Note · Endpoints & devices · By TechBag · Published 2026-06-02 · Facts checked 2026-09-30 · Canonical: https://www.thetechbag.com/blog/current-rmm-landscape-cloud-based-premise-solutions

Running your own RMM server buys you control of where the data sits, and it hands you a patch duty that attackers watch closely. Up to 30 September 2026, CISA’s catalogue of vulnerabilities known to be exploited held 26 entries in seven remote-monitoring, endpoint-management and remote-support products that customers host themselves; nine are marked as used in ransomware campaigns.[1] The 2024 version of this piece weighed cloud against on-premises RMM as a list of pros and cons. The question that decides it is narrower: when the fix ships, who installs it on the server that can reach every device you own?

## The server is the target

An RMM server holds an agent on every laptop and server in the estate, with the right to run scripts on them. Compromise it once and the attacker inherits that right. Kaseya’s July 2021 incident is the case on record: the company said fewer than 60 of its customers were directly compromised, “all of whom were using the VSA on-premises product”, with fewer than 1,500 downstream businesses hit, and that it had found no evidence any SaaS customer was compromised.[2] When ConnectWise disclosed a critical ScreenConnect flaw in February 2024, its bulletin told cloud partners there was nothing to do because their servers “have been updated”; self-hosted partners had to upgrade to 23.9.8 “immediately”.[3] In June 2025 CISA reported ransomware actors using unpatched SimpleHelp RMM servers, version 5.5.7 and earlier, to reach the customers of a utility billing software provider.[4]

**Figure: Five of seven self-hosted remote-management products had an exploited flaw added to CISA's list in 2026**

*Entries in CISA's Known Exploited Vulnerabilities catalogue by product, added November 2021 to 30 September 2026*

N-able N-central

3

2

5 entries

Ivanti Endpoint Manager

1

4

5 entries

ConnectWise ScreenConnect

2

2

4 entries

SimpleHelp

3

1

4 entries

BeyondTrust Remote Support

1

2

3 entries

Kaseya VSA

3

3 entries

ManageEngine Desktop Central

2

2 entries

|  | Added in 2026 | Added before 2026 |
| --- | --- | --- |
| N-able N-central | 3 | 2 |
| Ivanti Endpoint Manager | 1 | 4 |
| ConnectWise ScreenConnect | 2 | 2 |
| SimpleHelp | 3 | 1 |
| BeyondTrust Remote Support | 1 | 2 |
| Kaseya VSA | 0 | 3 |
| ManageEngine Desktop Central | 0 | 2 |

Source: CISA KEV catalogue (JSON feed), TechBag count · as of 30 September 2026 · Kaseya VSA last had an entry added in 2022, ManageEngine Desktop Central in 2021

TechBag countHow we counted

We filtered CISA’s feed to entries added on or before 30 September 2026, 1,730 in all, and kept the products a company can install on its own server to monitor, patch or remotely control its fleet. Ten of the 26 entries were added in 2026. Entries that span many products at once, client-side apps and help desks without device control were left out.[1]

## The cloud moves the duty; it does not remove the risk

The evidence against moving is real. On 28 May 2025 ConnectWise said it had found suspicious activity in its own environment, which it tied to “a sophisticated nation state actor”, and that it “affected a very small number of ScreenConnect customers”.[5] A cloud RMM concentrates every tenant behind one vendor’s controls. What it changes is who is on call: the vendor patches its service the night the fix exists, and a customer who never logs in to apply it is not left exposed.

Our view

Our view: self-host an RMM only when a regulator or a contract requires the data on your own premises, and then name the person who patches the RMM server within days of each fix, not at the next quarterly window. If nobody owns that, cloud is the safer choice for most Indian IT teams.

## If the data must stay in India

In TechBag’s RMM and patch guide, the situation “Regulated — on-prem or India data residency is mandatory” shortlists three products. ManageEngine Endpoint Central is the only one with both an on-premises edition and an India data centre; N-able N-central and ConnectWise Automate can be self-hosted on servers you place in India. Endpoint Central’s Professional on-prem edition lists at US$795 per 50 endpoints a year.[6] Under its former name, Desktop Central, it carries two of the 26 entries, both added in 2021.[1] The other self-hosted routes, ConnectWise Automate and Kaseya VSA on your own server among them, are listed in our [all-in-one RMM piece](https://www.thetechbag.com/blog/rmm-psa-remote-access-one-platform-or-three).[7]

In rupees, at the ₹83 to the dollar TechBag’s guides use, 50 endpoints of Endpoint Central Professional on-prem come to ₹65,985 a year, or ₹77,862 with 18% GST; cloud RMMs list in US dollars and are invoiced in INR through a reseller. The rules that bite run either way. CERT-In’s Directions of 28 April 2022 require incidents reported within six hours and ICT logs kept for 180 days within India, which for a self-hosted RMM means its own server logs too.[8] The DPDP Rules, notified on 13 November 2025, bring the security-safeguard duty into force on 13 May 2027.[9] Banks have the RBI’s Cybersecurity, Technology Risk and Resilience Framework Directions of 31 July 2026 on top.[10]

How we did this

Figures as of 30 September 2026

The exploited-vulnerability counts are TechBag’s count of CISA’s KEV JSON feed, entries whose date added is on or before 30 September 2026. A product is in scope if a customer can host its server and it monitors, patches or remotely controls endpoints. Excluded: ManageEngine entries covering many products at once (such as CVE-2022-47966), the TeamViewer desktop client, and SolarWinds Web Help Desk. Cloud-only RMMs such as NinjaOne, Atera and SuperOps have no entries; we draw no comparison from that, because a provider patches its own service without the customer acting. Residency and price facts are from TechBag’s RMM and patch guide as committed on 30 September 2026. The Kaseya, ConnectWise and SimpleHelp accounts are the vendors’ and CISA’s own words.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [CISA, Known Exploited Vulnerabilities catalogue (JSON feed); entries added to 30 September 2026, TechBag count](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) — entries dated November 2021 to 30 September 2026
2. [Kaseya, Important Notice July 2nd, 2021 (incident updates)](https://helpdesk.kaseya.com/hc/en-gb/articles/4403440684689-Important-Notice-July-2nd-2021) — updates of 5 and 6 July 2021
3. [ConnectWise, ScreenConnect 23.9.8 security bulletin](https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8) — 19 February 2024, updated 27 February 2024
4. [CISA, AA25-163A: Ransomware actors exploit unpatched SimpleHelp RMM to compromise a utility billing software provider](https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-163a) — 12 June 2025
5. [ConnectWise, May 28, 2025 Security Event Advisory](https://www.connectwise.com/company/trust/advisories) — 28 May 2025
6. [TechBag, RMM & Patch decision guide (situation s8: ManageEngine Endpoint Central, N-central and ConnectWise Automate; Endpoint Central Professional on-prem, US$795 per 50 endpoints a year)](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — undated page
7. [TechBag blog, One platform or three? All-in-one RMM is 1.5–4.8× cheaper on list; the catch is depth](https://www.thetechbag.com/blog/rmm-psa-remote-access-one-platform-or-three) — published 10 March 2025, facts as of 30 September 2026
8. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting, 180-day logs in India)](https://www.cert-in.org.in/Directions70B.jsp) — 28 April 2022
9. [MeitY, Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E))](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) — 13 November 2025
10. [RBI, Cybersecurity, Technology Risk and Resilience Framework Directions, 2026, via practitioner summary](https://taxguru.in/rbi/rbi-issues-commercial-banks-cybersecurity-technology-risk-resilience-framework-directions-2026.html) — 31 July 2026 RBI PDF not fetched.

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

Go deeper on TechBag

- [RMM & Patch decision guide](https://www.thetechbag.com/browse/endpoint-management/rmm-patch) — the products that pass an on-prem or India-residency requirement
- [ManageEngine Endpoint Central](https://www.thetechbag.com/manageengine/manageengine-endpoint-central) — on-premises edition and an India data centre, priced per 50 endpoints