Week in review: ScreenConnect servers open to attack, exploited Microsoft SharePoint flaw
2026-03-22T14:51:55Z•1902bf94f95cd7607156be77dc92b12042130300dd2908ed2fffa18009ffa689
AI-access-managementAI-fraudASP.NET-machineKeyAndroid-sideloadingCisco FMCConnectWiseDDoSDSPMInterlockIoT-botnetScreenConnectSemgrepcloud-securitycode-securitycyber-extortionransomwaresession-hijackzero-day
What happened
This week’s highlights include two critical, actively exploited vulnerabilities: CVE-2026-20131 in Cisco Secure Firewall Management Center, abused as a zero-day by the Interlock ransomware gang (exploitation observed ~36 days before public disclosure), and CVE-2026-3564 in ConnectWise ScreenConnect which allows ASP.NET machineKey-based session hijacking. Authorities disrupted four IoT botnets tied to record 30 Tbps DDoS attacks. Other notable items: Google tightened Android sideloading to reduce scam-driven installs; a conviction in a $2.5M cyber extortion scheme; an AI-enabled music-streaming
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- helpnetsecurity
- Record identifier
- 1902bf94f95cd7607156be77dc92b12042130300dd2908ed2fffa18009ffa689
- Enrichment time
- 2026-03-22T14:51:55Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.