Skip to content
ConnectWise App Identities Compromised, Microsoft 365 Tenants Breached

ConnectWise App Identities Compromised, Microsoft 365 Tenants Breached

First seen 20 Oct 2026, 18:11 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 20, 2026 at 19:16 UTC
  • •Seven ConnectWise application identities compromised, affecting Microsoft 365 tenants.
  • •Active exploitation of an OS command injection flaw in SiteGuard WAF for root access.
  • •Security teams should inspect AutoCAD DWG files for hidden malicious VBA projects.

On October 19, 2026, threat actors exploited an unpatched OS command injection vulnerability in SiteGuard Server Edition WAF, allowing them to gain root or SYSTEM privileges. Concurrently, seven ConnectWise application identities were compromised, leading to unauthorized access to customer Microsoft 365 tenants. Security teams are advised to inspect AutoCAD DWG files for hidden malicious payloads utilizing orphaned VBA projects. The vulnerability in SiteGuard is critical, with a CVE yet to be assigned. ConnectWise has suspended the affected application identities to mitigate the breach. Analysts recommend immediate auditing and revocation of permissions for the compromised identities. The situation remains critical as the exploitation of these vulnerabilities is ongoing.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-09-23
CVE-2026-96654 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96655 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96656 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-23
CVE-2026-96652 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
CVE-2026-15176 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
CVE-2026-0322 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-14
CVE-2026-76519 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-19
ConnectWise application identities compromised
Attackers exploited compromised identities to breach Microsoft 365 tenants, prompting ConnectWise to suspend seven applications.
Buttondown
2026-10-19
OS command injection vulnerability exploited
Threat actors exploited a critical OS command injection flaw in SiteGuard Server Edition WAF for unauthorized access.
Buttondown

More articles in this cluster (3)

Following this threat?

Track Infostealer, ConnectWise and CVE-2026-0322 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (28)

1 / 4

Common questions

What should we do if we use ConnectWise?
Audit and revoke permissions for the compromised application identities immediately.
Is the SiteGuard vulnerability patched?
No, the OS command injection vulnerability is currently unpatched and actively exploited.
How can we detect malicious VBA projects?
Use YARA rules specifically designed to identify orphaned VBA projects within AutoCAD DWG files.