ScreenConnect, N-central and the week MSP tools became the target
Active exploitation, nearly 1,000 Microsoft fixes, and a very good reason to move management platforms to the front of the patching queue.
September 14, 2026 • 9 minute read • Gabriel Guastella
The 60-Second Version
The tools we trust most need attention first.
Patch ScreenConnect clients and self-hosted N-central servers first. Both platforms have broad administrative reach, so a compromise could spread far beyond a single device or customer.
Next, prioritize Microsoft’s infrastructure updates, patch self-hosted GitLab, force Chrome updates and restarts, then schedule the latest PAN-OS and PaperCut releases.
The rule this week: Fix the tools with the greatest access before moving down the list.
Apparently, September decided IT teams were getting a little too comfortable. The biggest concern this week is the MSP control plane. Remote support and management platforms can reach hundreds or thousands of systems, so one compromised device can quickly become everyone’s problem.
01
ScreenConnect clients are being actively exploited
ConnectWise released ScreenConnect 26.6.5 on September 8 to address CVE-2026-84869, a CVSS 9.9 vulnerability that permits unauthorized file transfer and execution during an active remote session.
The vulnerable component is the ScreenConnect client, not just the server. A server upgrade starts the fix, but clients and access agents still need to receive the corrected code.
Why it matters
A compromised customer endpoint could potentially attack the technician or another system connecting through ScreenConnect. For an MSP, that is about as comfortable as discovering the fire extinguisher may also be spreading the fire.
What IT teams should do
- Upgrade on-premises ScreenConnect servers to version 26.6.5 or later.
- Reinstall host clients and update persistent access agents.
- Verify technician workstations are running the corrected client.
- Hunt for unexplained installations,
wscript.exeactivity, Run-key persistence, and files executed after remote sessions. - Isolate technician devices that connected to suspicious endpoints while vulnerable.
02
N-central Hotfix 4 replaces the previous fixes
N-able released Hotfix 4, build 2026.3.1.14, to fix CVE-2026-86218, a pre-authentication remote code execution vulnerability affecting the N-central server.
If you already installed Hotfix 3, unfortunately, you are not finished. Hosted N-central environments are patched, but self-hosted deployments require direct action.
Why it matters
Successful compromise of an RMM server could provide administrative reach across every customer and system managed through it. This is not simply another server to patch. It is a platform holding the keys to many other servers.
Patch and investigate
Upgrade self-hosted deployments to 2026.3.1.14, restrict console exposure, preserve server logs, and investigate unexplained sessions, scripts, automation jobs, or configuration changes across customer tenants.
03
Microsoft delivered nearly 1,000 reasons to postpone lunch
Microsoft’s September 8 security release addressed nearly 1,000 CVEs. Two actively exploited Windows privilege-escalation flaws, CVE-2026-81963 and CVE-2026-85880, can help an attacker reach SYSTEM after gaining an initial foothold.
Why it matters
This should not be handled as a routine workstation-only rollout. Critical infrastructure and internet-facing systems need their own accelerated schedule.
Verify, do not assume
Prioritize infrastructure servers, shorten the testing window for exposed systems, and verify installation and reboot status through RMM reporting. An approved update is not necessarily an installed update.
04
Self-hosted GitLab environments require immediate attention
GitLab released versions 19.3.2, 19.2.6, and 19.1.8 to address CVE-2026-85706. The CVSS 10.0 vulnerability allows an unauthenticated attacker to read arbitrary files through the repository commits API.
Why it matters
Readable files may contain database credentials, repository secrets, runner tokens, CI/CD variables, and deployment credentials. A file-read vulnerability can quickly become a larger supply-chain incident.
Protect the pipeline
Upgrade immediately, review logs for unusual commit-path requests, validate runner credentials, and rotate secrets if previous exposure cannot be ruled out.
05
Chrome suffered its second exploited V8 flaw in five days
Chrome 153 fixes CVE-2026-87491, an actively exploited out-of-bounds write vulnerability in the V8 JavaScript engine.
The familiar trap:
Chrome can remain vulnerable until the user actually restarts it. Closing a tab is not a restart. Minimizing the browser for three weeks definitely is not a restart.
Accelerate deployment, verify installed versions, and confirm browser restarts. Review Edge and other Chromium-based browsers separately.
06
Replace the PaperCut emergency builds
PaperCut released fully tested maintenance versions 26.0.5, 25.0.13, and 24.1.10. These replace Emergency Patches 1 through 3 and include additional security hardening.
Systems on Emergency Patch 1 or 2 should upgrade immediately.
Patch 3 systems can move during normal maintenance. Remember to update site and secondary servers, not only the primary Application Server.
07
PAN-OS vulnerability could provide root access
Palo Alto Networks disclosed CVE-2026-0310, which could allow an unauthenticated attacker with access to a management or dataplane interface to execute code as root on PA-Series hardware.
Why it matters
“Not currently known to be exploited” does not mean “safe to ignore.” Firewalls sit at the boundary between trusted and untrusted systems, and a root-level vulnerability deserves prompt attention.
Reduce exposure
Schedule the applicable fixed build, eliminate public management access, restrict administration to dedicated networks, and confirm configuration backups and recovery access.
Your order of operations
This week’s priority queue
When everything looks urgent, sequence matters. Start with the platforms that can reach the greatest number of downstream systems.
- ScreenConnect - Clients, access agents, technician devices
- N-central - Self-hosted servers and activity review
- Microsoft - Internet-facing infrastructure
- GitLab - Self-hosted environments
- Chrome - Deployment and restart compliance
- PAN-OS and PaperCut - Scheduled maintenance
The Watchdog takeaway
Management tools deserve more protection, not less.
If a platform can reach every endpoint, server, firewall, or customer environment you manage, it belongs at the front of the patching, monitoring, and incident-response queue.