CISA Adds ConnectWise ScreenConnect RCE to KEV Catalog — 'Patch Now,' Not 'Patch Later'

Published: May 8, 2026

Source: CISA KEV Catalog — CVE-2026-32202

Original Article: CISA Known Exploited Vulnerabilities Catalog

The Vulnerability: CVE-2026-32202

CISA has added CVE-2026-32202 — a critical remote code execution (RCE) vulnerability in ConnectWise ScreenConnect — to its Known Exploited Vulnerabilities (KEV) catalog. The vulnerability involves a critical path traversal flaw that gives an attacker full remote control of the ScreenConnect server.

What makes this especially dangerous:

• The vulnerability is actively exploited in the wild — meaning attackers are already using it
• ScreenConnect is used by thousands of MSPs and IT departments who manage systems for hundreds of SMB clients
• A compromised ScreenConnect server = remote access to every managed endpoint

ScreenConnect is the backdoor to hundreds of SMBs simultaneously. If an attacker compromises your MSP's ScreenConnect instance, they don't just get one machine — they get every machine that MSP manages. That's a supply chain attack waiting to happen.

Who's at Risk

• MSPs managing client infrastructure — Your ScreenConnect deployment is the single point of failure for every client you manage
• SMBs that rely on MSPs — If your MSP doesn't patch, your systems are at risk even if you patch everything else
• Internal IT teams — Any organization that uses ScreenConnect for internal remote support is vulnerable
• ConnectWise Self-Hosted customers — Cloud-hosted instances were patched, but self-hosted deployments remain at risk until patched

What You Need to Do

Today

1. Verify your ScreenConnect version — Check if you're running a vulnerable version
2. Patch immediately — Update to the latest version provided by ConnectWise
3. If self-hosted: Prioritize above everything else. This is actively exploited with full RCE

This Week

1. Audit your MSP relationship: If you use an MSP, ask them directly — are they patched? When was their last ScreenConnect update?
2. Review access logs: Check ScreenConnect for unusual connections, especially from unexpected locations
3. Verify your backup strategy: If ScreenConnect is compromised, you need verified backups ready to restore from

Why CISA's KEV Listing Matters

When CISA adds a vulnerability to the KEV catalog, it's a formal declaration: this is being exploited right now, by real attackers, against real targets. For federal agencies, KEV listings trigger mandatory patching timelines. For SMBs, it should trigger the same urgency — even if there's no regulation requiring it.

"Patch later" is not a strategy when CISA says the vulnerability is actively exploited. "Patch now" is.