Three tools IT companies use to reach your computers are on CISA’s exploited list. Ask yours if they’re patched.

Why this reaches a small business

Remote-support and management tools are how an IT company fixes your computers without driving over. They’re installed on every machine the company looks after, and they run with full control of it. A flaw in the tool, or in the server the IT company runs it from, can reach every one of those computers at once. That’s why attackers go after these products, and why CISA put all three on its exploited list within six weeks.

ConnectWise ScreenConnect

CVE-2026-84869, fixed in ScreenConnect 26.6.5 on September 8. ConnectWise says that in certain situations, files could be sent to and run on the computer being supported during a remote session, without the person at that computer approving it. ConnectWise scores it 9.9 and says the ScreenConnect server itself isn’t affected; the flaw is in the client.

Cloud instances were already updated. On-premises servers need the 26.6.5 upgrade (directly from 25.4 or later, with a license under maintenance), and every partner has to reinstall host clients and update access agents. Until then, ConnectWise suggests removing the TransferFiles permission from every role, and says that is not a substitute for the update. Its bulletin doesn’t say whether the flaw has been exploited. CISA added it to its exploited list on September 11.

BeyondTrust Remote Support

CVE-2026-102764, Remote Support 26.2.3 and earlier. Internal parts of the appliance don’t check where messages come from, so a remote attacker with no login can read and write files on it, which can lead to taking it over. NVD scores it 9.8; BeyondTrust scores it 9.3 under CVSS 4.0.

Cloud (SaaS) customers were patched automatically on October 8 or 9 (BleepingComputer and Canada’s Cyber Centre give different dates) and don’t need to do anything. Self-hosted appliances on 24.3.1 through 26.2.3 need the BT26-05-RS patch unless automatic updates are on; older versions have to be upgraded to a supported release first. BeyondTrust also patched Privileged Remote Access as a precaution. BleepingComputer reports that Google traced attacks back to late August, before any patch existed, and that Mandiant advises treating any exposed, unpatched appliance as possibly compromised.

N-able N-central

CVE-2026-86218, every version before 2026.3.1.14 (2026.3 Hotfix 4). Anyone who can reach an N-central server can run their own code on it without logging in. N-central manages every computer enrolled in it, so a compromised server is a route to all of them. NVD scores it 9.8; N-able scores it 10.0 under CVSS 4.0.

N-able’s hosted service (N-central On Demand) was patched for customers. On-premises servers have to be upgraded, and N-able says to do it immediately; there is no workaround. N-able’s status page said on September 5 that it had no confirmed exploitation. CISA added it to its exploited list three days later.

Three questions for your IT provider

1. Which remote-access and management tools do you use on our computers?You’re entitled to know what’s installed on your machines and who can use it.
2. Are they cloud or self-hosted, and what version are they on today?Self-hosted should be on ScreenConnect 26.6.5 or later, N-central 2026.3.1.14 or later, or BeyondTrust Remote Support with BT26-05-RS applied.
3. Since these were attacked, did you check for signs of misuse?ConnectWise’s own guidance after patching is to remove unknown users, review roles, change passwords and turn on multi-factor sign-in. A careful provider will have done the same for every tool, and can tell you so in writing.

Sources

• ConnectWise: ScreenConnect 26.6.5 security patch bulletin (September 8, 2026)
• Canadian Centre for Cyber Security: AL26-025, BeyondTrust Remote Support
• BleepingComputer: BeyondTrust patches zero-day exploited in attacks since August
• N-able status: N-central 2026.3 Hotfix 4, CVE-2026-86218
• CISA Known Exploited Vulnerabilities catalog
• Our vulnerability database: exploited flaws