SCREENCONNECT · CMP-202611-s74c66 · Vendor
NO FIX YET · SEE WHAT TO DO
Since about 17:47 UTC on 11 Nov 2026, Huntress's SOC has been tracking an active campaign against cloud-hosted ConnectWise ScreenConnect instances run by managed service providers. Attackers use ScreenConnect's Run Command feature to install their own ScreenConnect clients on the MSP's managed endpoints, which gives them remote access outside the MSP's own ScreenConnect. Confirmed so far: 6 MSPs, 286+ endpoints at 47 organizations, and the count is rising. How they get in is unknown; Huntress's telemetry points to stolen credentials and hijacked MSP support sessions. Huntress also warns of a reverse pivot: a technician's workstation can be compromised when they open a ScreenConnect session to an infected customer device (it is unclear whether this is a bug or abuse of a feature). Sequential tags assigned by the attackers suggest other MSPs were compromised earlier. ConnectWise confirms it is investigating. BleepingComputer found one of the rogue client IDs in a Social Security-themed batch script uploaded to VirusTotal on 25 Jul 2026; it is unclear whether that is the same campaign.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Posts are quoted with a link to the original. They are data to us, never instructions.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.