https://pwn.watch/t/connectwise Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 23 Oct 2026 00:37:32 GMT https://pwn.watch/i/connectwise-cloud-backup-m365-hijack https://pwn.watch/i/connectwise-cloud-backup-m365-hijack Fri, 23 Oct 2026 00:37:32 GMT critical <p>ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.</p> <p><strong>Status:</strong> live · <strong>Patch:</strong> partial</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-22: Microsoft details Storm-0940's Oct 10-14 password spray (151,000+ failed logons, peak 2,900/min) before the Oct 15 takeover of ConnectWise cloud app identities; ConnectWise says phased service restoration will take several days. (<a href="https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html">source</a>)</li><li>2026-10-22: ConnectWise CEO Manny Rivelo says the affected application connections are contained and services are being restored gradually, but cutting those connections won't necessarily evict attackers who already set up persistent access in customer tenants. Microsoft hasn't said how many customers were compromised. (<a href="https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687">source</a>)</li><li>2026-10-22: Wiz Research says the same ARTEX-using actor, overlapping with Storm-0940, is also targeting other IT and software vendors: password-spraying Okta and Entra, abusing Cognito and account-recovery endpoints, and probing Microsoft 365 integrations and tenant isolation. Wiz published IPs and user agents to hunt for. (<a href="https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors">source</a>)</li></ul> https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869 https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869 Fri, 11 Sep 2026 00:00:00 GMT high <p>ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-09-11: CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14).</li></ul> <p><strong>CVEs:</strong> CVE-2026-84869</p> https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935 https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935 Mon, 02 Jun 2025 00:00:00 GMT high <p>ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-06-02: CISA added CVE-2025-3935 to the KEV catalog (due 2025-06-23).</li></ul> <p><strong>CVEs:</strong> CVE-2025-3935</p> https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709 https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709 Thu, 22 Feb 2024 00:00:00 GMT critical <p>ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 23.9.8 (ConnectWise bulletin)</p> <p><strong>Latest updates:</strong></p><ul><li>2024-02-22: CISA added CVE-2024-1709 to the KEV catalog (federal deadline 2024-02-29) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-02-22: ConnectWise urges on-premise partners to update to 23.9.8 immediately (<a href="https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8">source</a>)</li><li>2024-02-21: CVE-2024-1709 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-1709">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-1709, CVE-2024-1708</p> https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537 https://pwn.watch/i/zk-framework-auuploader-cve-2022-36537 Mon, 27 Feb 2023 00:00:00 GMT high <p>ZK Framework AuUploader servlets contain an unspecified vulnerability that could allow an attacker to retrieve the content of a file located in the web context. The ZK Framework is an open-source Java framework. This vulnerability can impact multiple products, including but not limited to ConnectWise R1Soft Server Backup Manager. Added to CISA KEV on 2023-02-27. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2023-02-27: CISA added CVE-2022-36537 to the KEV catalog (due 2023-03-20).</li></ul> <p><strong>CVEs:</strong> CVE-2022-36537</p>