{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T17:37:12.278Z",
  "tag": {
    "id": "connectwise",
    "label": "ConnectWise",
    "isStack": false,
    "url": "https://pwn.watch/t/connectwise",
    "feed": "https://pwn.watch/t/connectwise/feed.xml"
  },
  "counts": {
    "incidents": 5,
    "live": 1,
    "notFullyPatched": 1,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "connectwise-cloud-backup-m365-hijack",
      "title": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack",
      "json": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "ConnectWise Cloud Backup / Microsoft 365 app identity",
      "tags": [
        "connectwise",
        "microsoft",
        "microsoft-365"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Cloud Backup service (shut down)"
      ],
      "fixedVersions": [],
      "startedAt": "2026-10-17",
      "closedAt": null,
      "updatedAt": "2026-10-22T19:14:54+02:00",
      "summary": "ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.",
      "xPost": null
    },
    {
      "slug": "connectwise-screenconnect-cve-2026-84869",
      "title": "ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869",
      "json": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "ConnectWise ScreenConnect",
      "tags": [
        "connectwise",
        "screenconnect",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-84869"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-11",
      "closedAt": "2026-09-11",
      "updatedAt": "2026-09-11",
      "summary": "ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11.",
      "xPost": null
    },
    {
      "slug": "connectwise-screenconnect-cve-2025-3935",
      "title": "ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability",
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935",
      "json": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "ConnectWise ScreenConnect",
      "tags": [
        "connectwise",
        "screenconnect",
        "cisa-kev",
        "rce",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2025-3935"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-06-02",
      "closedAt": "2025-06-02",
      "updatedAt": "2025-06-02",
      "summary": "ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.",
      "xPost": null
    },
    {
      "slug": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "title": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "json": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "ConnectWise ScreenConnect",
      "tags": [
        "connectwise",
        "screenconnect",
        "auth-bypass",
        "remote-access",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-1709",
        "CVE-2024-1708"
      ],
      "affectedVersions": [
        "ScreenConnect 23.9.7 and earlier (ConnectWise bulletin)"
      ],
      "fixedVersions": [
        "23.9.8 (ConnectWise bulletin)"
      ],
      "startedAt": "2024-02-19",
      "closedAt": "2024-02-22",
      "updatedAt": "2024-02-22",
      "summary": "ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "zk-framework-auuploader-cve-2022-36537",
      "title": "ZK Framework AuUploader: Unspecified (CVE-2022-36537)",
      "url": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537",
      "json": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "ZK Framework AuUploader",
      "tags": [
        "java",
        "zk-framework",
        "connectwise",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2022-36537"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-02-27",
      "closedAt": "2023-02-27",
      "updatedAt": "2023-02-27",
      "summary": "ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. Added to CISA KEV on 2023-02-27. CISA lists known use in ransomware campaigns.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "SC Media",
      "handle": "SCMagazine",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1382075890935468032/wEHUGLMA_bigger.jpg",
      "text": "A stolen @ConnectWise app credential exposed Microsoft 365 tenants to unauthorized access and privilege escalation. The breach highlights the risks of overprivileged app identities. #cybersecurity #CISO #infosec https://t.co/Xyi8IHRc6u",
      "date": "2026-10-22T13:28:01.000Z",
      "url": "https://x.com/SCMagazine/status/2113261090419233058",
      "media": [],
      "incident": "connectwise-cloud-backup-m365-hijack"
    },
    {
      "authorName": "The Register",
      "handle": "TheRegister",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1790422162228277252/Kn-bAizu_bigger.jpg",
      "text": "China-aligned attackers used AI agents and compromised ConnectWise application creds to target more than 2,250 Microsoft 365 tenants, the vendor says. \nMore here: https://t.co/CrHYzab3cD",
      "date": "2026-10-22T12:34:34.000Z",
      "url": "https://x.com/TheRegister/status/2113247638976102527",
      "media": [],
      "incident": "connectwise-cloud-backup-m365-hijack"
    }
  ],
  "changes": [
    {
      "incident": "connectwise-cloud-backup-m365-hijack",
      "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Microsoft details Storm-0940's Oct 10-14 password spray (151,000+ failed logons, peak 2,900/min) before the Oct 15 takeover of ConnectWise cloud app identities; ConnectWise says phased service restoration will take several days.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack"
    },
    {
      "incident": "connectwise-cloud-backup-m365-hijack",
      "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "ConnectWise CEO Manny Rivelo says the affected application connections are contained and services are being restored gradually, but cutting those connections won't necessarily evict attackers who already set up persistent access in customer tenants. Microsoft hasn't said how many customers were compromised.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack"
    },
    {
      "incident": "connectwise-cloud-backup-m365-hijack",
      "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-22",
      "title": "Wiz Research says the same ARTEX-using actor, overlapping with Storm-0940, is also targeting other IT and software vendors: password-spraying Okta and Entra, abusing Cognito and account-recovery endpoints, and probing Microsoft 365 integrations and tenant isolation. Wiz published IPs and user agents to hunt for.",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack"
    },
    {
      "incident": "connectwise-cloud-backup-m365-hijack",
      "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-21",
      "title": "Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, using the agentic AI framework ARTEX; 2,250+ Microsoft 365 tenants targeted.",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/",
      "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack"
    },
    {
      "incident": "connectwise-screenconnect-cve-2026-84869",
      "incidentTitle": "ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-11",
      "title": "CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869"
    },
    {
      "incident": "connectwise-screenconnect-cve-2025-3935",
      "incidentTitle": "ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-02",
      "title": "CISA added CVE-2025-3935 to the KEV catalog (due 2025-06-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-22",
      "title": "CISA added CVE-2024-1709 to the KEV catalog (federal deadline 2024-02-29)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-22",
      "title": "ConnectWise urges on-premise partners to update to 23.9.8 immediately",
      "body": null,
      "sourceUrl": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-21",
      "title": "CVE-2024-1709 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1709",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-21",
      "title": "CVE-2024-1708 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1708",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-19",
      "title": "Both vulnerabilities reported to ConnectWise; cloud instances remediated",
      "body": null,
      "sourceUrl": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "zk-framework-auuploader-cve-2022-36537",
      "incidentTitle": "ZK Framework AuUploader: Unspecified (CVE-2022-36537)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-02-27",
      "title": "CISA added CVE-2022-36537 to the KEV catalog (due 2023-03-20).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537"
    }
  ]
}