Project
Commercial remote-access and support software from ConnectWise, often abused by attackers to gain persistent remote control of systems.
Federal agencies now have three separate patch deadlines inside twelve days. The lowest-scoring pair of the five flaws added to KEV is the one with a documented 24-day intrusion campaign behind it.
Reality
CISA added two JFrog Artifactory access-control flaws and one ConnectWise ScreenConnect privilege flaw to the Known Exploited Vulnerabilities catalog on 11 September, and by the catalog's own criteria published mitigation guidance already exists for each.
Perspective Coverage
13 publishersReality
Microsoft says phishing emails seen in July 2026 deliver a signed MSP360 remote-management installer that then installs ConnectWise ScreenConnect. The chain uses no exploit, only a user's click and features the two admin tools ship with.
Perspective Coverage
3 publishersReality
Huntress says the modified client waits for a new host connection, then uses ScreenConnect's own file transfer and Run functions to place scripts on the operator's machine, which is why the interim guidance is a config toggle.
Reality
Trinity Cyber's deception workstation caught the same operator installing ScreenConnect from a batch file, reaching into LSASS by hand, then dropping FormBook into a signed binary. Two detection teams usually own those halves separately.
Reality