ConnectWise investigates ScreenConnect breaches at nearly 50 organizations
Original title: ConnectWise investigates ScreenConnect breaches after reports of incidents at nearly 50 organizations
Huntress saw 288 endpoints hit in 90 minutes; researchers link a toolkit to CVE-2026-84869.
ConnectWise is investigating unauthorized access after reports that almost 50 organizations were breached through ScreenConnect. The company says activity involves the independently developed RMM+ extension, found in about 400 partner environments, and that it disabled RMM+ where it could. Huntress reported 288 affected endpoints across 48 organizations within 90 minutes and has not seen a new vulnerability, pointing instead to compromised credentials or hijacked operator sessions. Blackpoint Cyber researchers say the attackers' toolkit exploits CVE-2026-84869, which CISA warned was exploited in September, and that a fully patched client blocked it in their tests.
Unconfirmed: ConnectWise and Huntress have not confirmed a new flaw; Blackpoint attributes the toolkit to CVE-2026-84869.
- RMM+ exposes an API that can run remote commands behind a partner-set passphrase.
- On-premises customers must disable RMM+ themselves.
- Attackers deployed extra remote-access software and persistent backdoors.
- Blackpoint says the September patch blocks CVE-2026-84869 but not hijacked operator sessions.
Impact: remote command execution and further malware on managed endpoints
| Product | Affected |
|---|---|
| ConnectWise ScreenConnect | unpatched clients for CVE-2026-84869 |
- 1.Verify RMM+ is disabled, including on on-premises ScreenConnect.
- 2.Treat disabling extensions and resetting credentials as incomplete if backdoors remain.
- 3.Watch for unusual ScreenConnect sign-ins and repeated login failures.
- CVEs
- CVE-2026-84869
- Vendors
- ConnectWise
- Products
- ScreenConnectRMM+
- Organizations
- HuntressBlackpoint CyberCISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84869 | Missing authorization in ScreenConnect client allows unauthorized file execution | 9.9 | <1% | KEV | KEV |
From the original article
3 min read at therecord.mediaAbuse of an independent third-party tool led to breaches at ScreenConnect customers, confirmed the software's maker, ConnectWise. Cybersecurity researchers had spotted intrusions at nearly 50.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.