ConnectWise started the week by warning customers about a new vulnerability in its widely deployed ScreenConnect remote access software — and for now, there is no patch. Administrators were handed temporary mitigation measures and told a proper fix would arrive later this week. For any organization that relies on remote monitoring and management (RMM) tooling to support distributed teams, that is the kind of advisory that turns a Monday morning into a fire drill.
It also capped a remarkable seven days. DefendEdge’s threat intelligence platform tracked more than 1,160 attack incidents over the past week, and 73 of them involved zero-day exploitation — attackers weaponizing flaws that were unknown or unpatched when the intrusion began. What makes this week unusual is not the raw volume; ransomware remains the single dominant threat we track, accounting for 486 incidents. It is the target pattern. Nearly every major zero-day story this week involves the same class of software: the remote access tools, routers, and management consoles that IT teams themselves depend on every day.
A Zero-Day Cluster Aimed at Trusted Software
Reviewing the week’s incident feed from sources including The Hacker News, SecurityWeek, BleepingComputer, CyberSecurityNews, and Infosecurity Magazine, one pattern stands out. Attackers are not primarily chasing end-user applications. They are going after the infrastructure layer: the RMM platform a managed service provider uses to reach client networks, the router guarding the network edge, the e-commerce server that processes payments, and the webmail platform employees authenticate to every morning.
This is not a random distribution. Infrastructure and management software is the highest-leverage target in any environment: one compromised RMM console or edge router can open the door to hundreds of downstream systems. When a vulnerability lands in that layer, defenders have very little time to act — and this week delivered several of those moments at once.
ScreenConnect: An Unpatched Flaw and a Worm
The most urgent advisory of the week came from ConnectWise itself. The company disclosed a new ScreenConnect remote access vulnerability and, because a patch is not yet available, shared only temporary mitigation measures while telling customers a fix is planned for later this week. Remote access software carrying a critical, unpatched flaw is effectively an open question mark hanging over every network that runs it. Organizations should treat the published mitigation guidance as mandatory hardening, not optional advice, and should be positioned to patch the moment the update ships.
Separately, and perhaps more unsettling, researchers at Huntress documented worm-like activity that abuses ScreenConnect itself as a distribution mechanism. Across three unrelated incidents, attackers used backdoored or modified ScreenConnect instances to push a malicious four-stage Visual Basic Script (VBScript) payload to newly connected client systems. The campaign is notable for both the diversity of its initial access and its propagation behavior: rather than targeting a single organization, the compromised remote access infrastructure spreads malware to every host that connects to it. If your RMM platform is your lifeline to remote systems, a campaign like this turns the lifeline into the attack vector.
122,500 Exposed Routers: MikroTik Under Active Exploitation
At the network edge, MikroTik RouterOS emerged as the week’s other actively exploited story. Attackers are chaining two recently disclosed vulnerabilities to seize control of routers with SSH services exposed to the internet. Researchers estimate that roughly 122,500 MikroTik routers currently expose their SSH port to the open internet, and emergency patches are now available. In a detail that says a great deal about where offensive security is heading, independent researchers are reportedly using AI to reverse-engineer the bugs — compressing the already short window between disclosure and working exploits.
Edge routers are a soft target for a simple reason: they are internet-facing by definition, they are frequently managed by staff without dedicated security training, and they sit directly on the trust boundary between an organization and everything else. A hijacked router enables traffic interception, DNS redirection, and a durable foothold that survives most internal remediation. It is the kind of compromise that is often discovered months too late.
From Online Stores to MSP Consoles: StyleSmuggler, N-able, and More
The zero-day wave did not stop at remote access. Attackers exploited a zero-day in Adobe Commerce and Magento — tracked in connection with a campaign researchers call StyleSmuggler — to execute code and deploy a stealthy backdoor on online stores. For retailers, the exposure is direct: a backdoored storefront can skim payment data, hijack checkout flows, and quietly harvest customer records for months before anyone notices.
MSP-side software took fire as well. N-able, a remote monitoring platform used heavily by managed service providers, shipped a hotfix for a critical remote code execution vulnerability — CVE-2026-86218 — that the vendor itself rated at maximum severity. An RCE in an RMM console is every MSP’s worst case, because the console inherently holds credentials and reach into dozens or hundreds of client environments. One flaw, many victims.
Two further advisories rounded out the week. A proof-of-concept published by TantoSec chains an AES-CBC padding oracle flaw in Telerik UI for ASP.NET AJAX into unauthenticated remote code execution; Progress patched the chain in July, so the risk now concentrates on organizations that still have not applied that update. And Roundcube patched twelve security flaws across its 1.6 LTS and 1.7 branches, including a zero-click cross-site scripting bug and a server-side request forgery bypass — a reminder that email infrastructure remains a favored foothold for both espionage and credential theft.
Meanwhile, a threat actor tracked as Nightmare Eclipse publicly dropped proof-of-concept exploits for zero-days affecting CrowdStrike, Nvidia, and Avast products — each enabling privilege escalation that spawns a shell with System-level privileges. Public PoCs of this quality materially lower the skill barrier: within days of such releases, opportunistic attackers typically fold them into commodity campaigns, which is why patch velocity matters more than CVSS scores alone.
Why Attackers Love the Remote Access Layer
There is a reason this week’s stories cluster around RMM tools, routers, and management consoles. These systems concentrate trust. A single remote access server, MSP console, or edge router often authenticates to — or sits in front of — large swaths of an organization’s estate. Compromising one does not yield one victim; it yields access at scale. The Huntress ScreenConnect worm is the starkest illustration: the malware did not need to go find new victims, because new victims connected to it.
There is also a timing advantage. Infrastructure software is patched less often than workstations, frequently runs on appliances that were set up once and forgotten, and is often excluded from standard vulnerability scans. Our weekly data underscores the stakes: the United States led all victim geographies this week with 81 tracked incidents, and healthcare (76), finance (65), and government (59) were the most-targeted sectors — industries where a single management-plane compromise can cascade into operational disruption, patient safety risk, and regulatory exposure.
What Your Organization Should Do Right Now
Inventory your remote access layer today. You cannot defend what you have not enumerated. Identify every RMM platform, remote support tool, edge router, and management console in your environment — including tools that individual teams deployed without central approval. Every incident this week shared one prerequisite: the attacker knew the tool was there before the defender did.
Apply the MikroTik emergency patches and the N-able hotfix immediately. Both fixes are available now, and both address actively exploited or maximum-severity flaws. Edge routers and RMM consoles belong at the very top of your patch queue, ahead of less-exposed internal systems that attackers cannot reach directly.
Deploy the ScreenConnect mitigations now, and patch the moment the update lands. Until ConnectWise ships the fix, treat the published mitigation measures as mandatory. Restrict which hosts can reach the ScreenConnect server, enforce multi-factor authentication for every remote session, and watch connection logs for unexpected new client enrollments — the worm campaign spread specifically through newly connected hosts.
Get management interfaces off the open internet. Roughly 122,500 MikroTik routers exposed SSH this week, and that management-plane exposure is what turned the RouterOS flaws into a mass-exploitation event. Place administrative interfaces behind VPN or zero-trust network access, and continuously scan your external attack surface for anything that should not be reachable. DefendEdge’s BlackBeam internet intelligence platform maps exposed assets and management interfaces continuously, so these blind spots surface before an attacker finds them.
Detect anomalous behavior in trusted software, not just known malware. The ScreenConnect worm arrived through legitimate-looking remote sessions, and a backdoored storefront kept processing normal transactions. Signature-based defenses miss both. Behavioral detection — new client enrollments, unexpected script execution chains, out-of-bounds admin sessions — is what surfaces these intrusions. A 24×7 US-based Security Operations Center exists to provide exactly this kind of continuous behavioral monitoring.
Re-prioritize your patch program around attacker behavior. The Telerik exploit chain only endangers systems that skipped a patch released two months ago. Threat-informed patching means tracking which vulnerabilities are being weaponized right now — the core of cyber threat intelligence — and sequencing those fixes first, rather than working through a backlog by severity score alone.
Stay Ahead of the Next Advisory
Zero-days in trusted infrastructure software will keep coming, because that is where the leverage is. The organizations that weather weeks like this one are those that know their remote access layer, patch aggressively the moment advisories land, and maintain continuous behavioral monitoring across their environment. DefendEdge’s US-based Security Operations Center delivers 24×7 monitoring, threat hunting, and incident response, and our cyber threat intelligence team tracks emerging zero-day exploitation as it happens — so you learn about the next ScreenConnect situation from your security team, not from the news. If your organization wants to stress-test its readiness for attacks like these, contact DefendEdge today.
Leave a Reply