ConnectWise warned of a new vulnerability in ScreenConnect, its widely used remote-access platform, affecting both cloud and on-premises deployments, and issued temporary mitigations while it prepares a patch. The flaw involves file-transfer behavior in remote-access sessions and has not yet received a CVE identifier. As an interim measure, administrators are told to disable file-transfer permissions in the ScreenConnect console. ScreenConnect is a favorite tool of managed-service providers and IT teams, which also makes it a repeated target: three earlier ScreenConnect flaws are in the exploited-vulnerabilities catalog, two abused in ransomware, and nearly 6,000 instances are exposed online. There is a concurrent campaign spreading malware through rogue ScreenConnect clients.
Researchers at ANY.RUN documented a phishing campaign spanning 46 countries, with about 45 percent of activity aimed at the United States, that tricks victims into installing legitimate remote monitoring and management software to give attackers persistent access. The lures pose as tax documents, invoices, shipping notices, and government messages, and the operation leans on disposable infrastructure hosted on trusted platforms like Vercel, GitHub Pages, and Netlify, with most hosts appearing for only a single day. Because the specific domains and remote-access tools are interchangeable while the delivery chain stays stable, defenders cannot rely on individual indicators or malware verdicts alone. Remote-management governance is the more durable control.
Citrix patched a critical flaw in NetScaler ADC and Gateway that lets a remote, unauthenticated attacker bypass authentication on appliances used for remote access. Tracked as CVE-2026-19490 and scored 9.3, it is an authentication-bypass issue affecting devices configured as a gateway for SSL VPN, ICA proxy, clientless VPN, or RDP proxy, or as an AAA authentication server. On newer builds it requires a SAML configuration, but on older builds any gateway or AAA configuration is exposed. There is no confirmed exploitation yet, but NetScaler appliances sit at the network edge and have repeatedly been attacked soon after disclosure, so patching is urgent.
Sophos detailed a campaign, tracked as STAC4749, in which attackers impersonate IT help desk staff over Microsoft Teams to talk employees into granting remote access, then deploy Chaos ransomware. Using external Teams accounts, the operators start chats and voice calls claiming to fix an urgent problem, persuade the target to open a remote support session, and run PowerShell to pull down a modular toolkit for persistence and lateral movement. Between February and June 2026 they hit dozens of North American organizations, about 95 percent in the US and Canada, across services, manufacturing, energy, and construction. In one case they went from first contact to encrypting files in under seventeen hours.
SonicWall is warning that two flaws in its SMA1000 remote-access appliances are being actively exploited as zero-days, and has released hotfixes. CVE-2026-15409 is an unauthenticated server-side request forgery bug in the appliance's WorkPlace interface that lets an attacker make the device send requests to internal systems, turning an edge gateway into a pivot point. CVE-2026-15410 is a code-injection flaw in the management console that lets an administrator run operating-system commands, and SonicWall rates the overall advisory a top CVSS score of 10.0. Both were added to CISA's exploited-vulnerabilities catalog, with a federal deadline of July 17. Because exploitation is confirmed, any unpatched appliance should be treated as potentially compromised.
BeyondTrust has patched two critical flaws in its Remote Support and Privileged Remote Access products that let an unauthenticated, network-positioned attacker bypass authentication and reach the appliance, including accounts with elevated privileges. The bugs, CVE-2026-40138 and CVE-2026-40139, both rated 9.2, sit in the authentication subsystem and depend on a specific authentication configuration being enabled. Cloud-hosted customers were patched automatically in April, but self-hosted deployments on version 25.3.2 or earlier need to update themselves. BeyondTrust has not reported exploitation, but its remote-support products have a history of being attacked, including flaws used to breach the US Treasury and to deploy ransomware, so internet-facing appliances should be patched quickly.
TrustStrike Labs