Researchers warn high-risk ConnectWise flaw under attack is ’embarrassingly easy’ to exploit

A high-severity authentication-bypass vulnerability in ConnectWise ScreenConnect is being actively exploited in the wild; ConnectWise released patches and shared three IP addresses tied to suspected threat actors, but telemetry from responders indicates thousands of vulnerable servers remain. Huntress and other analysts report attackers deploying Cobalt Strike and installing ScreenConnect clients on compromised systems, creating elevated risk of widespread ransomware and persistent intrusions—on‑premise users are urged to apply the vendor patch immediately.