ConnectWise patches ScreenConnect flaw used in worm-like attacks

What happened

SecurityWeek reports that ConnectWise has patched a ScreenConnect vulnerability that was exploited in attacks showing worm-like behavior. According to the supplied report, the flaw allows an attacker to send files and execute them without authorization through an active remote session.

The available information does not identify the attackers, provide a CVE identifier, specify affected or fixed versions, or quantify the number of organizations or systems involved. It also does not establish whether exploitation resulted in data theft, service disruption, or other downstream effects.

Organizations using ScreenConnect should therefore treat the report as an indication of active exploitation and review ConnectWise’s patch guidance, while avoiding assumptions about the scope or consequences of the activity.

Administrators should confirm whether their deployments are covered by the vendor’s fix, apply the relevant update following internal change procedures, and examine remote-session and endpoint telemetry for unusual file transfers or execution.

Because the supplied report describes behavior through active sessions, reviews should include access controls and session activity, not only conventional inbound network indicators.