VulnHub

Real-time Cybersecurity News

Critical

SCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths

The Hacker News
Actively Exploited
CVEVulnerabilityMalwareCritical

Overview

A recent campaign is exploiting a serious vulnerability in ConnectWise ScreenConnect, a remote access software used by many managed service providers (MSPs). Researchers from Blackpoint Cyber's Adversary Pursuit Group found that attackers are leveraging a previously patched flaw identified as CVE-2026-84869, which has a high severity score of 9.9. This vulnerability allows unauthorized access during support sessions, potentially opening the door for further attacks on MSPs and their clients. The ongoing exploitation of this flaw underscores the need for users to ensure they have applied the latest security updates. Companies relying on ScreenConnect should take immediate action to protect their systems from potential compromises.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: ConnectWise ScreenConnect software, versions affected not specified.
  • Action Required: Users should ensure that they have applied the latest patches from ConnectWise for ScreenConnect to close this vulnerability.
  • Timeline: Disclosed on [date not specified]

Original Article Summary

The ongoing campaign targeting ConnectWise ScreenConnect deployments involves the exploitation of a now-patched critical security flaw in the remote access software, and not a new vulnerability, it has emerged. Blackpoint Cyber's Adversary Pursuit Group (APG), which shared the details with The Hacker News, said the recovered attacker toolkit exploits CVE-2026-84869 (CVSS score: 9.9), an

Impact

ConnectWise ScreenConnect software, versions affected not specified.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on [date not specified]

Remediation

Users should ensure that they have applied the latest patches from ConnectWise for ScreenConnect to close this vulnerability. Regularly updating software and monitoring security advisories is recommended.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Malware, and 1 more.

Read Original Article

Related Coverage

Critical Red Hat Quay Flaw Lets Attackers Read and Overwrite All Private Container Images in a Registry

The Hacker News

A significant vulnerability in Red Hat Quay has been identified, allowing attackers to read and overwrite private container images within any registry. This flaw is particularly concerning because Quay enables anonymous access by default, meaning attackers can exploit this vulnerability without needing an account. Even if anonymous access is disabled, anyone with a valid account can still take advantage of the flaw. Red Hat has released fixed builds for eight versions of Quay to address this issue. Organizations using Quay should prioritize updating their systems to prevent potential data breaches and unauthorized access to sensitive container images.

Nov 12, 2026

Citrix Patches 12 NetScaler and Secure Access Client Flaws, Including Authentication Bypass

The Hacker News

Citrix has issued patches for 12 critical vulnerabilities affecting its NetScaler products, including NetScaler ADC, NetScaler Gateway, and NetScaler Console. These flaws could allow attackers to perform authentication bypass or cause denial-of-service (DoS) attacks. One of the most critical vulnerabilities, identified as CVE-2026-120868, has a high severity rating of 9.3 on the CVSS scale, indicating it poses a significant risk. Companies using these products should prioritize applying the patches to protect against potential exploitation. The vulnerabilities could impact the integrity and availability of services relying on these Citrix solutions.

Nov 12, 2026

186 Fake AI Domains Redirect Users to ClickFix Lures, Browser Malware, and Search Hijackers

The Hacker News

Researchers have discovered a network of 186 fake domains that impersonate legitimate AI tools. These lookalike sites are designed to trick users into clicking on links that lead to malware, specifically ClickFix-style lures that hijack browser functions and manipulate search results. This tactic, referred to as TypoPrompting, exploits users' familiarity with popular AI applications to redirect them to malicious content. As a result, unsuspecting users may unintentionally download harmful software or have their online activities compromised. This incident serves as a reminder for users to be cautious when accessing AI tools and to verify the authenticity of websites before entering any personal information.

Nov 12, 2026

Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs

The Hacker News

Google Cloud has issued a warning regarding three vulnerabilities found in AMD Turin CPUs used in their virtual machines (VMs). These flaws could allow an attacker to access data from other processes running on the same processor core within a VM. Google has already implemented measures to prevent attacks between VMs and between VMs and their host systems. However, to fully protect against these vulnerabilities, users must apply a patch to the guest operating system and restart their VMs. This situation is significant because it highlights the potential risks of shared resources in cloud environments, where multiple users operate on the same hardware.

Nov 12, 2026

Critical Pre-Auth MongoDB Flaw (CVE-2026-118383) Can Crash Lagging Servers on Failover

The Hacker News

A serious vulnerability has been discovered in MongoDB Server, identified as CVE-2026-118383. This flaw allows attackers to send two specific requests that can cause the database server to crash. The issue arises particularly when a server, which is lagging behind in updates, is promoted to the main server role. MongoDB has responded quickly, releasing fixed versions to address this vulnerability. It's crucial for users of MongoDB to apply these updates to prevent potential disruptions in their database operations, especially in environments that rely on server failover for continuity.

Nov 12, 2026

Node.js Fixes 16 Flaws, Including HTTP/2 Bugs That Crash Servers and Leak Other Connections' Data

The Hacker News

Node.js has patched 16 vulnerabilities, including critical flaws in its HTTP/2 support that could allow unauthenticated users to crash servers running versions 24.x and 26.x. One vulnerability could lead to a denial-of-service attack, while another could expose sensitive data by sending memory contents from the server to clients, potentially revealing information meant for other connections. The fixed versions are 22.23.5, 24.22.3, and 26.13.1. It’s crucial for developers and organizations using Node.js to update their systems to these latest versions to protect against these issues and ensure server stability and data security.

Nov 12, 2026