Skip to content
Malware Spread via ScreenConnect Plugin Flaw Affects Hundreds of PCs

Malware Spread via ScreenConnect Plugin Flaw Affects Hundreds of PCs

First seen 12 Nov 2026, 15:50 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 12, 2026 at 18:47 UTC
  • •Hackers exploit a vulnerability in ScreenConnect to spread malware.
  • •The flaw may allow bypassing multi-factor authentication.
  • •ConnectWise has disabled third-party extensions in 400 environments.

Hackers are exploiting a vulnerability in the ScreenConnect plugin to distribute malware across hundreds of PCs. The flaw allows unauthorized access, potentially bypassing multi-factor authentication (MFA). ConnectWise has disabled third-party extensions in 400 environments as a precaution. The vulnerability has raised concerns about the security of remote access tools, with the exact CVE number not specified. Organizations using affected versions of ScreenConnect are advised to take immediate action to secure their systems. The attack appears to be widespread, impacting numerous users and organizations relying on this remote access software. As of now, there is no confirmed patch for the vulnerability, and the situation remains critical.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 1h ago How this analysis works

Timeline

2026-11-12
Malware exploitation reported
Hackers are actively exploiting a vulnerability in the ScreenConnect plugin to spread malware across hundreds of PCs.
Theregister
2026-11-12
ConnectWise disables extensions
ConnectWise disabled third-party extensions in 400 environments to mitigate the risk from the vulnerability.
Theregister

More articles in this cluster (5)

Extracted Entities (5)

1 / 3

Common questions

What is the nature of the vulnerability?
The vulnerability in the ScreenConnect plugin allows unauthorized access and may bypass multi-factor authentication.
How widespread is the malware attack?
The malware is reported to be spreading across hundreds of PCs, affecting numerous organizations.
What actions should organizations take?
Organizations should disable third-party extensions and monitor for unusual activity while awaiting a patch.