# SZB-7ade08c64f: ConnectWise investigates active campaign abusing compromised ScreenConnect environments

ConnectWise is investigating an active malware campaign that targets managed service providers, according to the report.

- Type: Breach
- Status: Corroborated
- Vendor: ConnectWise
- Product: ScreenConnect
- Disclosed: 2026-11-11 22:04 UTC
- Sources: 2 distinct
- First seen by cve.now: 2026-11-11 22:06 UTC · Updated: 2026-11-11 23:00 UTC

> No statement or filing from ConnectWise has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## Summary

The campaign reportedly uses compromised ScreenConnect environments to install rogue remote-access clients on customer devices, and the report says dozens of organizations may be affected.

## What to do

- Audit ScreenConnect instances for unrecognized users, sessions, and remote-access clients
- Check endpoints for unexpected ScreenConnect or remote-access software installations
- Rotate ScreenConnect and related administrative credentials
- Restrict ScreenConnect access to trusted networks and enforce MFA

## Timeline

- 2026-11-11 22:04 UTC: Made public by BleepingComputer
- 2026-11-11 22:06 UTC: First seen by cve.now

## Evidence (2 sources)

- 2026-11-11 · Social · [r/sysadmin](https://www.reddit.com/r/sysadmin/comments/1xtv482/just_switched_from_connectwise_to_ninjaone_6/): “their MSP told them today that Connectise got breached globally”
- 2026-11-11 · Press · [BleepingComputer](https://www.bleepingcomputer.com/news/security/active-screenconnect-attacks-breach-msps-impact-dozens-of-organizations/): “ConnectWise is investigating an active malware campaign targeting managed service providers (MSPs) that uses compromised ScreenConnect environments to deploy rogue remote-access clients to customer devices.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-7ade08c64f&body=https%3A%2F%2Fcve.now%2FSZB-7ade08c64f%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about the ConnectWise breach

### Was ConnectWise breached?

BleepingComputer reports it. No statement from ConnectWise has reached cve.now yet.

### What should ConnectWise customers do?

Audit ScreenConnect instances for unrecognized users, sessions, and remote-access clients. Check endpoints for unexpected ScreenConnect or remote-access software installations. Rotate ScreenConnect and related administrative credentials. Restrict ScreenConnect access to trusted networks and enforce MFA.

## Related

- Started as early warning SZB-7ade08c64f, first seen 2026-11-11 22:06 UTC
- Browse: [Breaches](https://cve.now/breaches.md) · [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/SZB-7ade08c64f
Site guide for agents: https://cve.now/llms.txt