SC Media
@SCMagazine
A stolen @ConnectWise app credential exposed Microsoft 365 tenants to unauthorized access and privilege escalation. The breach highlights the risks of overprivileged app identities. #cybersecurity #CISO #infosec t.co/Xyi8IHRc6u
// tag
ConnectWise
Security incidents tagged ConnectWise. Newest first.
- incidents
- 5
- live
- 1
- patched
- 4
## 2 ConnectWise incidents in the last 12 months
crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore
- criticallivepartial fixsince Oct 17, 2026
ConnectWise Cloud Backup shut down after M365 app-identity hijack
› ConnectWise Cloud Backup / Microsoft 365 app identity
ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.
show 4 older incidents4 older incidents
September 2026 1
highConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerabilitypatched
› ConnectWise ScreenConnect patched
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11.
open incident →CVE-2026-84869
June 2025 1
highConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerabilitypatched
› ConnectWise ScreenConnect patched
ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.
open incident →CVE-2025-3935
February 2024 1
criticalConnectWise ScreenConnect auth bypass mass-exploitedpatched
› ConnectWise ScreenConnect patched
ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.
open incident →CVE-2024-1709 · CVE-2024-1708
February 2023 1
highZK Framework AuUploader: Unspecified (CVE-2022-36537)patched
› ZK Framework AuUploader patched
ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. Added to CISA KEV on 2023-02-27. CISA lists known use in ransomware campaigns.
open incident →CVE-2022-36537
## posts 2
- › ConnectWise Cloud Backup shut down after M365 app-identity hijack
- › ConnectWise Cloud Backup shut down after M365 app-identity hijack
The Register@TheRegisterChina-aligned attackers used AI agents and compromised ConnectWise application creds to target more than 2,250 Microsoft 365 tenants, the vendor says. More here: t.co/CrHYzab3cD
