Loading story…
ConnectWise ScreenConnect disclosed a critical vulnerability, CVE-2026-3564 (CVSS 9.0), affecting versions prior to 26.1. The flaw stems from ScreenConnect storing unique per-instance machine keys and related cryptographic material in plaintext server configuration files, creating a path for attackers under certain conditions to extract those keys and abuse them for unauthorized access. The issue is classified as CWE-347: Improper Verification of Cryptographic Signature, and successful exploitation can undermine confidentiality, integrity, and availability in environments that rely on ScreenConnect for remote access.
With the exposed machine keys, an attacker could forge or manipulate session authentication tokens, hijack legitimate sessions, and elevate access without user interaction. ConnectWise rated the issue as high priority, and the Centre for Cybersecurity Belgium urged organizations to patch immediately, monitor for suspicious activity, and treat updates as protection against future exploitation rather than proof that no prior compromise occurred. The vendor states the issue is fixed in version 26.1, making rapid remediation and post-patch review important for on-premises deployments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In guidance reflected by CSIRT.SK on March 19, 2026, ConnectWise said it had observed exploitation attempts targeting the critical ScreenConnect flaw CVE-2026-3564. The company reiterated that vulnerable versions earlier than 26.1 should be upgraded immediately, while cloud-hosted instances were automatically secured.
On March 18, 2026, government cybersecurity bodies including Belgium's CCB and Canada's Cyber Centre amplified ConnectWise's advisory and urged organizations to review guidance and apply the 26.1 update promptly. Their notices highlighted the severity of the issue for ScreenConnect deployments prior to version 26.1.
On March 17, 2026, ConnectWise disclosed a critical vulnerability in ScreenConnect affecting all versions prior to 26.1 that could let attackers extract or abuse ASP.NET machine keys, hijack session authentication, gain unauthorized access, and escalate privileges. The company urged on-premises customers to treat remediation as urgent and said it had no evidence of active exploitation of this specific CVE.
ConnectWise published a security bulletin for ScreenConnect 26.1 security hardening, addressing a critical flaw later tracked as CVE-2026-3564. The update introduced stronger machine key protections, including encrypted storage and improved key management, and cloud-hosted instances were already mitigated.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcescworld.com
Open sourcecsirt.sk
Open sourcecyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcebleepingcomputer.com
Open sourceccb.belgium.be
Open sourceconnectwise.com
Open sourceconnectwise.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ConnectWise released a security update for ScreenConnect to address a critical vulnerability, tracked as CVE-2025-14265, which affects the server component of the remote access platform. The flaw, caused by improper code integrity validation during extension installations (CWE-494), could allow attackers with authorized or administrative access to expose sensitive configuration data and install untrusted extensions. The vulnerability carries a CVSS 3.1 base score of 9.1, highlighting its severity, though ConnectWise reports no evidence of active exploitation at this time. The issue impacts all ScreenConnect versions prior to 25.8, and the 25.8 patch enforces stricter server-side validation and integrity checks for extension installations. ConnectWise has automatically applied updates to cloud-hosted ScreenConnect instances, while on-premises users must manually upgrade to version 25.8. Partners using Automate integration are advised to update their Automate ScreenConnect Extension before upgrading ScreenConnect itself. Security advisories from both ConnectWise and the Canadian Centre for Cyber Security urge organizations to prioritize patching to prevent potential unauthorized access and maintain secure remote management environments. The vulnerability is rated as Priority 2 – Moderate, with a recommended update window of 30 days, but immediate action is encouraged due to the risk of sensitive data exposure.
Jun 29, 2026
Threat actors including **Black Basta** have been actively exploiting recent **ConnectWise ScreenConnect** vulnerabilities to gain access to victim environments, then using that foothold to deepen control and prepare for follow-on attacks. Trend Micro reported post-compromise reconnaissance against domain controllers, including enumeration of domain computers, trusts, domain controllers, and local administrators, indicating efforts to map enterprise networks and identify privileged access. Attackers were also observed deploying additional remote management tools to maintain persistence and broaden remote access. In compromised environments, they abused **BITSAdmin** to download and execute another ScreenConnect client from `transfer[.]sh`, and in several European targets—mostly in **Belgium**—they installed trial versions of **Atera RMM** using `msiexec` parameters linked to an Outlook email account and account identifiers. Researchers warned that the activity could quickly progress to **ransomware deployment**, data theft, operational disruption, and financial losses, making immediate patching to the latest ScreenConnect version critical.
Jun 29, 2026
Ivanti released fixes for a newly disclosed high-severity flaw in its on-premises Endpoint Manager Mobile (**EPMM**) platform, tracked as `CVE-2026-6973`, after confirming limited zero-day exploitation. The vulnerability is caused by improper input validation and can lead to arbitrary code execution when a remote attacker already has administrator-level access. Ivanti said the issue affects EPMM `12.8.0.0` and earlier and issued patched versions `12.6.1.1`, `12.7.0.1`, and `12.8.0.1`, while urging customers to review privileged accounts and rotate credentials. The disclosure adds to a longer pattern of Ivanti security incidents: CISA previously warned that `CVE-2023-35082`, a critical authentication bypass flaw in Ivanti EPMM and MobileIron Core, was being actively exploited to gain unauthenticated API access, expose user data, and potentially backdoor servers when chained with other vulnerabilities. ConnectWise also disclosed a critical vulnerability in **ConnectWise Automate**, tracked as `CVE-2026-9089`, affecting versions prior to `2026.5`. The flaw, classified as `CWE-494`, stems from insufficient integrity verification during plugin loading and self-update operations and could allow malicious code execution on client machines during agent updates under specific network conditions. ConnectWise assigned the issue a CVSS score of **8.8**, automatically updated cloud deployments, and instructed on-premises customers to manually upgrade to version `2026.5`; Canada’s Cyber Centre separately urged administrators to apply the vendor update. The disclosures highlight continued risk across widely deployed enterprise management platforms, with internet exposure data showing hundreds of Ivanti EPMM systems and broad operational dependence on remote monitoring and mobile device management software.
Jun 29, 2026