A ScreenConnect campaign and actively exploited flaws in Cisco BroadWorks and Xen Orchestra put managed-service providers, telecom operators and virtualization teams on alert.
A campaign targeting ConnectWise ScreenConnect and urgent warnings about Cisco BroadWorks and Xen Orchestra put managed-service providers and infrastructure teams on notice. Huntress said it observed the ScreenConnect activity on November 11, affecting at least 288 hosts across 48 organizations. The campaign involved a third-party RMM+ extension. Huntress has not observed a successful jump from an infected endpoint to a technician workstation.
That distinction matters: the findings point to risk for customer systems but do not establish that attackers spread into technicians’ machines. Huntress warns defenders not to use ScreenConnect to investigate suspected hosts. An interactive connection could expose the technician’s workstation and other systems it can reach, potentially creating another route for attackers.
The campaign reportedly abused RMM+ extension versions 1.0.31 and 1.0.32, which accepted a blank access key if an administrator had not configured one. Attackers deployed rogue ScreenConnect clients and SCKit, a toolkit capable of persistent access, session-cookie interception and self-replication. ConnectWise disabled five RMM+ family extensions across about 400 ScreenConnect environments. Huntress said the campaign affected current RMM software versions 26.6.6.9747 and 26.7.6.9783.
ScreenConnect users should establish whether RMM+ was installed and whether an access key was configured. Huntress recommends responding out of band: isolate suspected hosts, revoke sessions, rotate credentials, and review Run Command and Toolbox histories. Teams should avoid connecting directly to a suspected machine, check relevant indicators of compromise, and coordinate with their service provider to determine which customer endpoints were exposed.
Cisco BroadWorks operators face a separate, actively exploited risk. CISA added CVE-2026-20320 to its Known Exploited Vulnerabilities catalog on November 10. The flaw allows an unauthenticated attacker to read sensitive files by sending crafted XML to the BroadWorks Open Client Interface Provisioning service. Federal civilian agencies have until November 24 to remediate, but other operators should not treat that deadline as a reason to wait.
BroadWorks is used by carriers and service providers for cloud phone and collaboration services. Operators should check Cisco’s guidance, prioritize a fix or mitigation, and investigate access to the affected service and sensitive files. Because BroadWorks supports customer services, providers should also assess whether exposed systems or credentials could affect connected environments.
Xen Orchestra administrators should also act quickly. The management platform, used with XCP-ng and XenServer, is being exploited in attacks that may expose reusable login-token IDs. BleepingComputer reported that attackers could use them to gain Admin privileges, execute code on managed pools and take over XCP-ng nodes as root. Application logs may not reveal exploitation, making HTTP monitoring important.
Teams should restrict management interfaces to trusted networks, review HTTP activity and rotate credentials if compromise is suspected. The management layer can control multiple virtual machines and hosts, so an investigation should include the managed pool—not just the Xen Orchestra appliance. For confirmed compromise, teams should follow vendor guidance on recovery and consider rebuilding affected systems rather than relying on a password change alone.
The common risk is privileged management software that can reach many systems at once. Small IT teams should inventory these products, limit administrative access, and ensure response devices do not share credentials or network access with suspected hosts. The reports establish active exploitation of BroadWorks and Xen Orchestra and a ScreenConnect campaign; they do not establish that every affected endpoint led to a broader compromise. Teams should preserve relevant evidence and involve providers where they lack visibility.
Ryan Mitchell serves as a Staff Writer for Just Right News, where he anchors the desk for Cyber, Technology Policy, and Digital Sovereignty. In an era where the digital landscape has become as much a battlefield as any physical territory, Ryan provides a critical conservative lens on the forces shaping the future of American innovation and national security. His work is defined by a commitment to the idea that American leadership in the digital age is not just a matter of economic success, but a necessity for the preservation of global liberty.
Born and raised in Austin, Texas, Ryan’s perspective is deeply rooted in the Lone Star State’s tradition of independence and skepticism of centralized authority. Growing up in a city that transformed from a quiet state capital into a global technology hub, he witnessed firsthand the disruptive power of the tech industry. This upbringing instilled in him a firm belief in free-market principles and the necessity of protecting individual liberties from both government overreach and corporate overstep. His Texan background serves as a foundational compass, guiding his reporting toward stories that emphasize national resilience and the preservation of constitutional values in an increasingly virtual world.
Now based in San Francisco, California, Ryan operates from the epicenter of the very industry he scrutinizes. Living and working in the heart of Silicon Valley allows him to provide “boots on the ground” reporting that few conservative journalists can match. He navigates the cultural and political complexities of the Bay Area to bring Just Right News readers an inside look at the boardrooms and coding labs where the next generation of digital policy is forged. For Ryan, being stationed in San Francisco is a strategic choice; it allows him to challenge the prevailing ideological monoculture of the tech elite from within their own backyard, ensuring that the concerns of middle America are represented in the conversation about our digital future.
His beat—Cyber, Technology Policy, and Digital Sovereignty—covers the high-stakes world of data privacy, artificial intelligence, and the infrastructure of the modern web. Ryan is particularly focused on the concept of digital sovereignty, arguing that for a nation to remain truly free, it must maintain control over its own technological destiny and critical infrastructure. He frequently explores how international regulations and domestic policies impact the ability of American firms to compete without sacrificing the privacy or security of their citizens.
Central to his current body of work is his featured series, “The New Cold War.” Through this project, Ryan examines the escalating technological rivalry between the United States and its global adversaries. He delves into the complexities of state-sponsored hacking, the global race for semiconductor dominance, and the ideological struggle to define the rules of the internet. Ryan views this competition not merely as a commercial race, but as a fundamental defense of Western values against authoritarian digital models. Through his rigorous reporting and principled analysis, Ryan Mitchell ensures that the readers of Just Right News stay informed about the invisible forces defining the 21st century, always advocating for a future where technology serves the cause of freedom.