ConnectWise warned of a new vulnerability in ScreenConnect, its widely used remote-access platform, affecting both cloud and on-premises deployments, and issued temporary mitigations while it prepares a patch. The flaw involves file-transfer behavior in remote-access sessions and has not yet received a CVE identifier. As an interim measure, administrators are told to disable file-transfer permissions in the ScreenConnect console. ScreenConnect is a favorite tool of managed-service providers and IT teams, which also makes it a repeated target: three earlier ScreenConnect flaws are in the exploited-vulnerabilities catalog, two abused in ransomware, and nearly 6,000 instances are exposed online. There is a concurrent campaign spreading malware through rogue ScreenConnect clients.
N-able released its fourth hotfix in five weeks for its N-central remote monitoring and management platform, this time for a flaw that gives an unauthenticated attacker full "god-mode" access to the console. Tracked as CVE-2026-86218 and scored 10.0, the pre-authentication remote code execution zero-day is being exploited and supersedes all earlier hotfixes, so on-premises systems still on the third hotfix remain vulnerable and must apply the fourth. Hosted instances have already been patched. Researchers also disclosed a separate chain that lets attackers bypass access controls to create unauthorized administrator accounts. Because N-central manages many downstream endpoints, a compromise can cascade across every customer it serves.
N-able is warning that attackers exploited an authentication bypass in N-central, the remote monitoring and management platform used by managed service providers and IT teams to administer customer endpoints. The flaw, CVE-2026-18556, allows unauthenticated administrative account takeover, and N-able's initial fix in one release proved incomplete: it found another way to exploit the same weakness, tracked as CVE-2026-18577, that widened the affected range. After taking over a server, attackers used its remote-control feature to reach managed endpoints and installed Cloudflare tunnels as services, which kept access alive even after the route through the N-central server was cut. Build 2026.3.1.7 is the first unaffected version.
Kaspersky is tracking an active campaign that spreads through WhatsApp by hijacking real accounts and sending their contacts a script file disguised as a business or financial document, with no accompanying message. If a Windows user opens it, the script disables User Account Control protections and silently installs ManageEngine Endpoint Central, a legitimate IT remote-management tool, configured to connect to attacker servers and hand them remote control of the machine. Using trusted contacts and signed, legitimate software helps the attack slip past suspicion and many security tools. The campaign spans several countries, with most confirmed victims in Malaysia, and how the WhatsApp accounts are compromised is still unknown.
A critical flaw in SimpleHelp, a remote support and management tool used by IT teams and managed service providers, lets an unauthenticated attacker create a privileged technician account and skip multi-factor authentication. The bug (CVE-2026-48558) only affects servers configured to use OpenID Connect (OIDC) single sign-on, including Azure AD, and stems from how the server validates identity assertions from the login provider. A rogue technician can then remote into managed machines and run scripts, giving attackers a foothold across every connected endpoint. Researchers found roughly 14,000 SimpleHelp servers exposed online, with about 7 percent using the vulnerable OIDC setup. The flaw affects versions 5.5.15 and earlier.
Mandiant has detailed how the extortion crew Silent Ransom Group (also tracked as Luna Moth and UNC3753) is breaking into US law firms and other professional-services companies through phone calls rather than malware. Attackers send a harmless-looking invoice or data-migration email, then call the target pretending to be internal IT support, talk them into starting a screen-share, and get them to install a remote management tool that hands over access. From there, Mandiant has seen data located, staged, and stolen in under an hour. The group skips encryption entirely, instead threatening to leak stolen files unless paid. A recent FBI alert added in-person office visits to the playbook.
CISA added four flaws to KEV on April 24 with a May 8 federal deadline. The headline is CVE-2024-57726 (CVSS 9.9), a missing authorization in SimpleHelp RMM that lets a low-privileged technician mint API keys above their role and escalate to server admin; companion CVE-2024-57728 (CVSS 7.2) chains a path traversal for RCE. SimpleHelp featured in DragonForce and Akira ransomware campaigns last year. CVE-2024-7399 (CVSS 8.8) is a Samsung MagicINFO 9 path traversal with a public PoC since 2024. The fourth, CVE-2025-29635, is the D-Link DIR-823X bug we covered last week.
TrustStrike Labs