DanSec

Vendor

ConnectWise

In 29 briefs, most recently 23 October 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

4 ConnectWise vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 2 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Capcom ID breach of 11.7M accounts, LiteLLM PyPI supply chain attack, and actively exploited Arista VeloCloud zero-day.
  2. Railway secrets exposure, Onamae VPS malware on 26,739 servers, LiteLLM supply chain attack, and critical PHP2Shell RCE flaws under mass exploitation.
  3. OVHcloud CLI and Rank Math PRO supply chain compromises, the Ahold Delhaize cyberattack, and actively exploited Plex2Shell flaws.
  4. ConnectWise cloud outage, ETS breach exposing millions of California student records, and OpenCode legacy breach exposing stored AI API keys.
  5. ConnectWise suspends Cloud Backup after Microsoft 365 tenant breaches; Drupal patches two critical RCE flaws; AI security hiring rises.
  6. Burger King Japan breach of 11.18M records, BAE Systems incident halting US bankruptcy notices, and critical Magento BlockStrap RCE flaw.
  7. Flock camera footage dumped by hackers, a WordPress plugin backdoored on about 1,500 sites, and a WSO2 JWT bypass under active exploitation.
  8. Revolut and Telus data breaches, a Twitch extension leaking OAuth tokens, and GitLab and ScreenConnect exploitation.
  9. Microsoft cloud account phishing and email-service fraud, CISA KEV adds for JFrog, ConnectWise and MikroTik, and Check Point VPN exploitation warnings.
  10. Mathspace breach hits over 1M users, MikroTik RouterOS and N-able N-central zero-days exploited, and North Korean HAProxy backdoor campaign in South Korea.
  11. Oracle database hack via khunt toolkit, Snowflake data theft guilty plea, and actively exploited JetBrains TeamCity RCE.
  12. Unitel cyberattack before its IPO, a tl;dv Firebase flaw exposing private meetings, and ChainDrop malware compromising 1,300+ npm packages.
  13. Trellix source code breach, DigiCert certificate revocations after a chat-channel attack, and 40,000+ servers compromised via the cPanel flaw CVE-2026-41940.
  14. The TeamPCP SAP npm supply chain attack, Checkmarx GitHub data theft, and a five-year dormant WordPress plugin backdoor affecting 70,000+ sites.
  15. Infinite Campus and HackerOne breaches, TeamPCP's LiteLLM PyPI supply chain attack, and malvertising abusing a Huawei driver to kill EDR.
  16. Cisco FMC zero-day exploited by Interlock ransomware, Stryker cyberattack tied to Iranian-linked Handala, and Aura breach exposing nearly 900,000 contacts.
  17. Cox Enterprises Oracle EBS breach, WhatsApp scraping of 3.5B phone numbers, and APT31 targeting Russian IT firms.
  18. F5 breach, Muji ransomware outage via Askul, AWS two-hour outage, and Salt Typhoon's Snappybee attack on a European telecom, plus GlassWorm and WatchGuard …
  19. Envoy Air's Oracle EBS data theft claimed by Clop, Prosper's breach of 17.6 million accounts, and Zendesk email bombing.
  20. The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
  21. Miljödata breach disrupts 200+ Swedish municipalities; Citrix NetScaler flaw CVE-2025-7775 exploited; Salesforce data theft via Salesloft Drift OAuth tokens.
  22. Citrix NetScaler 'CitrixBleed 2' exploitation, Cyber Fattah's leak of 2024 Saudi Games data, and arrests of BreachForums operators in France.
  23. Paragon Graphite spyware hit journalists' iPhones, EchoLeak exposed Microsoft 365 Copilot, and 80,000 Entra ID accounts faced password spraying.
  24. Erie Insurance cyberattack, INTERPOL's Operation Secure takedown of infostealer infrastructure, and a Microsoft WebDAV zero-day exploited by Stealth Falcon.
  25. The TxDOT crash-records data breach, Microsoft's June 2025 Patch Tuesday zero-days, and the six-hour Heroku outage.
  26. Kettering Health ransomware claim, AT&T breach data re-release, and BADBOX 2.0 botnet infecting over 1 million IoT devices.
  27. Victoria's Secret earnings delay, Coinbase data breach via bribed TaskUs staff, and Scattered Spider's attacks on UK retailers Marks & Spencer and Co-op.
  28. ConnectWise ScreenConnect breach by a suspected nation-state, AVCheck takedown, and China-linked Earth Lamia exploiting SAP NetWeaver and SQL Server flaws.
  29. ConnectWise ScreenConnect breach by suspected nation-state, DragonForce ransomware via SimpleHelp RMM, and Victoria's Secret site outage.