Repeated Authentication Attempts Against ScreenConnect Web Interface (CVE-2026-8

Ibrahim Saud@tektrix

•updated 23 days ago•0•0•3

Detects repeated HTTP POST requests containing 'ScreenConnect' in the URI, originating from external networks. This pattern is indicative of automated scanning activity attempting to exploit potential authentication bypass or session hijacking vulnerabilities (such as CVE-2026-84869) in ConnectWise ScreenConnect instances.