Search: “ScreenConnect”

Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity

Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.

Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.

Huntress·Sep 3, 08:50 UTC · 13d agoExploit / PoC in the wild1

Modified ScreenConnect Clients Used in Worm-Like Campaign

Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.

Campaigns starting in late August use social engineering, including Quick Assist abuse, to install rogue ScreenConnect clients that spawn wscript.exe and deploy four VBScript files for reconnaissance, staging, and PowerShell execution. The attackers persist via User Run Keys, attempt UAC bypass, install UltraViewer, and propagate the VBScript chain to other connected ScreenConnect endpoints. ConnectWise published an advisory about a file transfer behavior issue affecting cloud and on-premises ScreenConnect, with a CVE identifier and fix expected within a week; it recommends disabling file transfer meanwhile.

SecurityWeek·Sep 7, 11:45 UTC · 9d agoExploit / PoC in the wild

Attackers use rogue ScreenConnect clients to spread malware

Attackers deploy rogue ScreenConnect clients that spread VBScript malware to newly connected machines while ConnectWise patches a file-transfer flaw.

ConnectWise confirmed a file transfer flaw in ScreenConnect affecting both Cloud and On-Premise deployments, with a CVE identifier and official fix promised within the week; administrators can mitigate immediately by disabling TransferFiles (or TransferFilesInSession) in each role. Huntress documented incidents where social engineering installs rogue ScreenConnect clients that spawn Windows Script Host processes running four VBScript files (1.vbs-4.vbs), add a WindowsServiceHost registry Run key, and propagate to newly connected endpoints. Payloads enabled host profiling, persistence, additional ScreenConnect installs, tunneling, security-control changes, and cryptocurrency mining. ConnectWise has not confirmed a technical link between the flaw and this campaign.

Help Net Security·Sep 7, 00:00 UTC · 9d agoExploit / PoC in the wild

U.S. CISA adds ASUS RT-AX55 devices, Craft CMS, and ConnectWise ScreenConnect flaws to its Known Exploited Vulnerabilities catalog

Security Affairs·Jun 3, 19:35 UTC · Jun 3, 2025Exploit / PoC in the wildCVE-2021-32030CVE-2023-39780CVE-2024-56145+2 CVEs

Chinese government hacker exploiting ScreenConnect, F5 bugs to attack defense and government entities

The Record·Mar 21, 20:48 UTC · Mar 21, 2024Exploit / PoCCVE-2024-1709CVE-2023-46747

CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA added three actively exploited vulnerabilities — two JFrog Artifactory and one ConnectWise ScreenConnect — to its KEV Catalog.

CISA added CVE-2026-42016 (JFrog Artifactory incorrect authorization), CVE-2026-42018 (JFrog Artifactory improper authentication), and CVE-2026-84869 (ConnectWise ScreenConnect improper privilege management and missing authorization) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of such high-risk vulnerabilities on publicly exposed assets and to check for prior compromise. CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.

CISA Advisories·Sep 11, 12:00 UTC · 5d agoExploit / PoC in the wildCVE-2026-42016CVE-2026-42018CVE-2026-84869

Acronis Patches Exploited Vulnerability in cPanel Backup Plugin

Acronis urgently patched CVE-2026-87886 (CVSS 7.8), insecure file permissions enabling privilege escalation, exploited in targeted attacks on cPanel & WHM backups.

Acronis released urgent patches for CVE-2026-87886 (CVSS 7.8), insecure file permissions in the Backup plugin for cPanel & WHM and the Backup extension for Plesk that allow attackers to gain elevated privileges. Exploitation has been detected in the wild in limited, targeted attacks against the cPanel & WHM plugin, but not against the Plesk extension. All Linux versions of the plugin before build 1.9.3.1021 and the Plesk extension before build 1.8.11.638 are affected; Acronis urges immediate updates and has not shared technical details.

SecurityWeek·updated 11:08 UTC · 3h ago·first 09:52 UTC · 4h agoExploit / PoC in the wild 6 sourcesCVE-2026-87886

U.S. CISA adds Android and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog

Security Affairs·Jun 3, 10:43 UTC · Jun 3, 2026Exploit / PoC in the wildCVE-2022-0492CVE-2025-48595

U.S. CISA adds Daemon Tools, TanStack, and Nx Console flaws to its Known Exploited Vulnerabilities catalog

Security Affairs·May 28, 13:14 UTC · May 28, 2026Exploit / PoC in the wildCVE-2026-8398CVE-2026-45321CVE-2026-48027