Critical ScreenConnect flaw now actively exploited in attacks. Sep 16, 2026 // 14:16 - Niko Dunn Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). ConnectWise shared temporary mitigation measures for this missing-authorization flaw on September 7, advising security teams to disable TransferFiles permissions to block potential attacks. The vulnerability (now tracked as CVE-2026-84869 and patched in ScreenConnect 26.6.5 and later) affects ScreenConnect clients and can let threat actors with basic privileges transfer or execute files in low-complexity attacks that don't require user interaction. CISA added the security flaw to its catalog of actively exploited flaws on Friday and ordered U.S. federal agencies to secure their systems against ongoing attacks within three days. "ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation," CISA said. "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise." Since 2024, CISA has flagged four ScreenConnect security issues as actively exploited, two of which have also been abused in ransomware attacks. Internet threat watchdog Shadowserver now tracks over 1,000 ScreenConnect instances still unpatched and exposed to attacks online, most of them from North America (758) and Europe (180). ScreenConnect vulnerabilities are often targeted in the wild by both financially-motivated and state-backed hacking groups. For instance, the North Korean-backed Kimsuky hacking group and several ransomware gangs exploited another ScreenConnect flaw (CVE-2024-1709) in 2024. Last year, ConnectWise also rotated digital code-signing certificates after disclosing that suspected state-sponsored hackers breached its systems through code injection attacks that exploited a ViewState flaw (CVE-2025-3935) and accessed the cloud-based instances of a limited number of customers. More recently, in March, ConnectWise addressed a cryptographic signature verification vulnerability (CVE-2026-3564) that could allow attackers to hijack unpatched ScreenConnect servers. ConnectWise provides services to more than 100,000 IT providers worldwide, with many managed service providers (MSPs) and IT teams using its ScreenConnect remote access platform for troubleshooting, patching, and system maintenance.

Giacom & ConnectWise announced as strategic partners. Last Updated: September 16, 2026 CompareIT has partnered with Giacom and ConnectWise to broaden the reach of its AI-powered MSP comparison and monitoring platform. Both partners serve UK managed service providers at scale, and both are supporting the platform so MSPs receive better-fitting opportunities and SMEs get a data-led way to find a new IT provider. (52 words) What has CompareIT announced? CompareIT has announced strategic partnerships with Giacom and ConnectWise, alongside the launch of its comparison and monitoring platform at compareit.co.uk on 1 September 2026. The principle behind both partnerships is reach: putting the platform in front of more managed service providers, and in turn giving more SMEs access to a comparison built on declared, independently checked data rather than search rankings. The platform lists all over 8,000 UK MSPs, with up to 197 declared data points per provider, checked against Companies House, Google, Trustpilot, Glassdoor and Creditsafe feeds (CompareIT platform data, August 2026). What did Giacom's CEO say about the partnership? Terry O'Brien, CEO of Giacom, framed the partnership around the quality of new business opportunities rather than the quantity. He said: "One of the hardest things for MSPs is finding good-quality new business opportunities." He added: "Simon and Mark understand that challenge first-hand, having built and run successful MSPs themselves. We think they've created a really valuable service for the channel and we're very pleased to support its launch." Two things are worth drawing out of that. First, the constraint for most MSPs is not lead volume but fit: opportunities that match the sectors, sizes and service models they are actually built for. Second, the endorsement is a channel endorsement, from a business whose customers are MSPs, of a platform that only works if MSPs are visible on it. What did ConnectWise say about the partnership? Russ Humphries, EVP, Product Management - Security and Data Protection at ConnectWise, framed the partnership around the complexity MSP customers are now dealing with. He said: "Finding new business opportunities remains an important challenge for MSPs, especially as customers navigate increasing complexity across cybersecurity, agentic AI and broader technology needs." He added: "CompareIT is bringing a fresh approach to how businesses discover MSPs and how MSPs connect with prospective customers who need that expertise. We're pleased to see continued innovation focused on helping MSPs grow and build stronger customer relationships." Two things are worth drawing out of that. First, the buying problem is now a capability problem: customers need cybersecurity, agentic AI and wider technology expertise, and they need a way to tell which MSPs actually hold it. Second, the endorsement comes from a vendor whose software runs inside MSP businesses, which makes it a comment on how MSPs win work as much as on the platform itself. What does the partnership change for MSPs? It widens the pool of buyers who can find an MSP on capability rather than marketing spend. Four effects follow: · Better-fitting enquiries, because the buyer has already filtered on accreditations, sector experience, in-house capability and service model before making contact. · Lower cost of acquisition, against an MSP market average of over £1,000 per marketing qualified lead (Sales Meddic Market Data, July 2026). · Visibility that is not bought, because all 8,000 UK MSPs are listed free rather than ranked by advertising budget. · Comparison on capability and culture, using declared data checked against independent sources. Simon McAlpine, co-founder of CompareIT, said: "We wanted to create a better way for businesses and MSPs to find each other, where providers can compete on capability and culture rather than marketing budget, and businesses can find a partner that genuinely fits what they need." What does it change for SMEs looking for a new IT provider? It makes the whole market visible at the point of choosing. SMEs are changing provider 3.6 times more frequently than they were three years ago, and MSP retention has fallen to an industry average of 89% (Analysis Marson, February 2026; Sales Meddic Market Data, July 2026). More MSPs on the platform means a shortlist drawn from capability data rather than page one of a search engine. How does CompareIT work? Three tools for an SME buyer: * Compare Search: filter all 8,000 UK MSPs on the data points that matter to you, then enquire with your shortlist in one action. * AI-Search: a guided search from a trained AI agent, so a non-technical buyer can build a credible shortlist. * Compare Monitor: track a current or prospective MSP for operational, financial and cultural change, upload your MSA for an AI analysis of risky clauses, and get renewal and notice-period alerts.

Critical ScreenConnect flaw now actively exploited in attacks. * September 16, 2026 * 07:14 AM * 0 Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). ConnectWise shared temporary mitigation measures for this missing-authorization flaw on September 7, advising security teams to disable TransferFiles permissions to block potential attacks. The vulnerability (now tracked as CVE-2026-84869 and patched in ScreenConnect 26.6.5 and later) affects ScreenConnect clients and can let threat actors with basic privileges transfer or execute files in low-complexity attacks that don't require user interaction. CISA added the security flaw to its catalog of actively exploited flaws on Friday and ordered U.S. federal agencies to secure their systems against ongoing attacks within three days. "ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation," CISA said. "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise." Since 2024, CISA has flagged four ScreenConnect security issues as actively exploited, two of which have also been abused in ransomware attacks. Internet threat watchdog Shadowserver now tracks over 1,000 ScreenConnect instances still unpatched and exposed to attacks online, most of them from North America (758) and Europe (180). ScreenConnect vulnerabilities are often targeted in the wild by both financially-motivated and state-backed hacking groups. For instance, the North Korean-backed Kimsuky hacking group and several ransomware gangs exploited another ScreenConnect flaw (CVE-2024-1709) in 2024. Last year, ConnectWise also rotated digital code-signing certificates after disclosing that suspected state-sponsored hackers breached its systems through code injection attacks that exploited a ViewState flaw (CVE-2025-3935) and accessed the cloud-based instances of a limited number of customers. More recently, in March, ConnectWise addressed a cryptographic signature verification vulnerability (CVE-2026-3564) that could allow attackers to hijack unpatched ScreenConnect servers. ConnectWise provides services to more than 100,000 IT providers worldwide, with many managed service providers (MSPs) and IT teams using its ScreenConnect remote access platform for troubleshooting, patching, and system maintenance. Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.