Attackers are chaining two unpatched AhsayCBS flaws to run code as SYSTEM and plant webshells and XMRig miners, according to Huntress. Managed service providers are the main users of the console, so the hosts being hit are the ones that manage backup users and policies for clients.
Perspective Coverage
6 publishers
- Builder
- Builder 22%
- Operator
- Operator 71%
- Investor
- Investor 7%
Reality
- Evidence74
- Adoption
- Not scored
- Hype gap+8
- Incentives30
- Confidence76
CVE-2026-84869 lets an attacker run files inside a live ScreenConnect session
The bug lets files be pushed and executed through a remote session the host already approved, and CISA says attackers are doing it now. It is ScreenConnect's fourth entry on the KEV catalog since 2024.
Reality
- Evidence62
- Adoption42
- Hype gap+18
- Incentives68
- Confidence58
CISA gives federal agencies three days to fix the ScreenConnect flaw already under attack
ConnectWise's stopgap is to switch off file transfers in ScreenConnect, and with CISA's exploited-flaw listing now carrying a three-day federal deadline, more than 1,000 exposed servers still run the unpatched build.
Reality
- Evidence62
- Adoption70
- Hype gap+12
- Incentives45
- Confidence60
Attackers seized MSP N-central servers through the bypass N-able's incomplete fix left open
N-able's fix for one N-central authentication bypass produced another that was already being exploited, and the hotfix for that was replaced four days later. Three N-central CVEs now sit in CISA's exploited catalog.
Publishers:rapid7.com
Reality
- Evidence64
- Adoption58
- Hype gap−8
- Incentives58
- Confidence62
N-able Passportal leaked whole vaults to any page: v3.49.6 stops the leak, not the tokens
A missing origin check let any site pull an MSP's decrypted vault and keep access for up to 100 days, according to the researchers who found it. Installing the patch does not retire tokens already taken.
Publishers:amibeingpwned.com
Reality
- Evidence63
- Adoption58
- Hype gap+14
- Incentives62
- Confidence56