Is Datto down?

We are aware of a problem where Datto BCDR users in the UK region may experience degraded offsite performance, potentially impacting synchronization operations. The Kaseya Engineering Team is investigating the issue and working towards a resolution. Should you need any additional questions or require assistance, please contact our support team at https://helpdesk.kaseya.com/hc/en-gb#/contact Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/

We are aware of a problem where Datto AV is incorrectly flagging newly created .pdf files as PHISH/PDF, causing the files to be quarantined. The Kaseya R&D Team is currently investigating this issue. In the meantime our Support team has been supplied with a workaround and can assist you with implementing it. If you would like to have the workaround applied, please create a ticket with our Support team or contact them at 833-863-2237. To work around this issue: Adding exclusions for the affected folders and files. Then restoring the affected files. Subscribe to the Kaseya Status Page for up-to-date information at https://status.kaseya.com/

Our engineering team has identified the issue and is monitoring the fix. Some PDF files, were incorrectly flagged as PHISH/PDF.Agent. A specific detection rule has been disabled in VDF 8.21.8.130, deployed October 28, 2026. The rest of the PHISH detection category remains active. We are monitoring to confirm new false positives have stopped. Files that have already been quarantined must be restored manually.

Two critical vulnerabilities in PHP allow unauthenticated remote code execution. Kaseya security teams are assessing all Kaseya systems and products and applying fixes as they become available. This page is the source of truth for Kaseya status and guidance. Product Status: All products: Customer action: none Kaseya corporate infrastructure: Customer action: none Third-party components in Kaseya products: Customer action: none

Kaseya is aware of two critical vulnerabilities in PHP: CVE-2026-109618 and CVE-2026-109619. CVE-2026-109618 involves a remote code execution vulnerability where handling out-of-memory errors via longjmp() leaves request memory uninitialized due to improper control flow management, potentially allowing attackers to achieve remote code execution using out-of-memory (OOM) triggers. CVE-2026-109619 describes a remote code execution vulnerability where longjmp() fatal error handling leaves global memory pointing to freed memory regions. These regions can later be accessed during subsequent requests, potentially enabling arbitrary code execution. Kaseya has completed an evaluation of its product portfolio regarding these vulnerabilities. A summary of the current status across impacted products and services is provided in the table below. As our investigation and remediation efforts continue, we will keep the following list updated with the latest information. Here is what each status means: Fully Patched: The fix has been applied. Compensating Controls: The product is impacted, protective controls are in place, and we are working to remediate. Unaffected: The product is not affected by these vulnerabilities. Product Status: AudIT - Unaffected Autotask PSA - Compensating Controls Azure - Files - Unaffected BMS - Fully patched Connect Booster - Unaffected Datto Backup For Azure - Unaffected Datto BCDR - Compensating Controls Datto Direct to Cloud Products - Compensating Controls Datto EDR - Unaffected Datto Networking - Compensating Controls Datto Partner Portal - Compensating Controls Datto RMM - Compensating Controls Datto SaaS Defense - Unaffected Datto SaaS Protection + Backupify - Compensating Controls Datto Workplace + File Protect - Compensating Controls Endpoint Backup V2 - Compensating Controls Graphus - Unaffected ID Agent - Compensating Controls Inky - Unaffected IT Glue - Unaffected Kaseya One - Unaffected Kaseya Quote Manager - Compensating Controls Kaseya MDM - Unaffected Microsoft Entra Backup - Unaffected MyITProcess - Unaffected Passly - Unaffected RapidFire Tools - Compensating Controls RocketCyber - Compensating Controls SaaS Alerts -Unaffected Secure Payments - Compensating Controls Spanning - Compensating Controls Unitrends - Compensating Controls UniView - Unaffected vPenTest - Fully Patched VSA 10 - Fully Patched VSA 9 - Compensating Controls We will continue to provide updates as additional information becomes available. Please contact your account manager with questions.

A third party vendor, ConnectWise, recently reported attempts of unauthorized access associated with the ConnectWise Cloud Backup environment. ConnectWise has initiated their incident response procedures, and have applied containment measures as they continue to investigate. At this time, according to ConnectWise there is no indication that ConnectWise partner backup data has been accessed. All additional updates related to this incident can be found on the ConnectWise Status Page at status.connectwise.com. As part of our ongoing security monitoring efforts, the Kaseya Security Operations Center deployed additional detection measures on October 16, 2026, targeting publicly disclosed indicators of compromise. Activity matching these indicators is automatically designated as critical severity and promptly reviewed by our security analysts. The Kaseya product team has also deployed a fortify action within SaaS Alerts and KSIEM environments to help mitigate this risk further. Please follow the steps below to apply the fortify action: Action Name: Disable ConnectWise Cloud Backup and Cloud Management apps Steps to Deploy within SaaS Alerts and KSIEM portal: Within the left menu, under "Modules", select Fortify → Actions, then perform the following: 1. Set Select Product to Microsoft. 2. Set Select Organization to the customer's org (or leave it on All), and leave Select Actions on All. 3. Click Show Actions. 4. Search for Disable ConnectWise Cloud Backup and Cloud Management apps in the search box. 5. Under the action's buttons, click the wand icon labelled Apply. If you feel you have been compromised due to this issue, please contact Kaseya support.