Dutch Institute for Vulnerability Disclosure
Dutch coordinated vulnerability disclosure organisation and CVE Numbering Authority.
The Dutch Institute for Vulnerability Disclosure warned Kaseya about seven VSA zero-day flaws from 6 April 2021, almost three months before the REvil gang hit VSA servers on 2 July through one that was still unpatched.
Last refreshed: 12 October 2026
Who warned Kaseya about VSA flaws months before REvil struck?
Timeline for Dutch Institute for Vulnerability Disclosure
Named as Dutch Institute for Vulnerability Disclosure
Cybersecurity: Threats and Defences: Mentioned in: CISA flags N-central flaw as exploitedBackground
The Dutch Institute for Vulnerability Disclosure (DIVD) is a volunteer organisation in the Netherlands that scans the internet for exposed, vulnerable systems and alerts whoever can fix them, without charge. DIVD vets its volunteers, and most hold cybersecurity jobs by day. DIVD is also a CVE Numbering Authority.
Its defining case came in 2021. Volunteer Wietse Boonstra found seven zero-day flaws in Kaseya's VSA remote-management software in March and April, among them the credential leak CVE-2021-30116. DIVD contacted Kaseya on 6 April, and Kaseya shipped fixes in stages from May. On 2 July the REvil ransomware gang struck VSA servers through a flaw that was still open. Within 48 hours DIVD had tracked internet-reachable VSA servers as their number fell from more than 2,000 to 140.
Kaseya VSA belongs to the same class of tool as N-able's N-central, the console IT outsourcers use to run client machines, which CISA listed as exploited on 8 September 2026.