ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

Critical Flaw Turned RMM Sessions Into a Spreading Mechanism

ConnectWise has patched a critical vulnerability in its widely deployed ScreenConnect remote monitoring and management (RMM) tool after it was exploited in worm-like attacks that propagated across connected client sessions.

Vulnerability Details

How the Attacks Spread

Threat actors deployed modified ScreenConnect instances to propagate malicious payloads to connected targets. Documented campaigns involved four malicious VBScript files designed to establish persistence and self-replicate across systems reachable through active remote sessions. Social engineering was used to trick users into running the rogue ScreenConnect clients in the first place, after which the file-transfer/execute flaw allowed the attack to spread without further authorization checks.

Because ScreenConnect is deployed by MSPs to manage large numbers of downstream client endpoints, a single compromised technician session could give attackers a path to numerous connected environments.

Patch and Mitigation

ConnectWise resolved the issue in ScreenConnect 26.6.5, which "strengthens client and session handling for file-transfer and file-execution actions."

Recommended Actions

1. Update to ScreenConnect 26.6.5 or later immediately.
2. Temporarily disable the TransferFiles permission in ScreenConnect if you cannot patch right away.
3. Audit active and historical sessions for unauthorized file transfers or execution of unrecognized VBScript files.
4. Federal agencies are required to patch within three days under the CISA Known Exploited Vulnerabilities (KEV) catalog mandate (BOD 26-04), reflecting the severity and active exploitation status.
5. MSPs specifically should treat this as urgent — worm-like propagation through RMM tooling can rapidly cascade across every downstream client tenant.

Why This Matters

RMM platforms like ScreenConnect sit at a uniquely privileged point in the supply chain: a single MSP technician's session often has administrative reach into dozens or hundreds of client networks. Vulnerabilities that enable unauthorized file transfer and execution inside that trust relationship — especially ones capable of worm-like spread — represent some of the highest-leverage targets for ransomware affiliates and other financially motivated threat actors.

Related Reading

• Surge in Bomgar RMM Exploitation Demonstrates Supply Chain Risk
• CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV