ConnectWise credentials led straight into Microsoft 365 tenants
The development that matters most for anyone running Microsoft 365 came from two reports on October 17. Attackers used compromised ConnectWise backup credentials to break into 173 Microsoft 365 accounts across customer tenants. BleepingComputer frames this as a supply-chain attack through ConnectWise, which means the trust you extended to a backup and remote management vendor became the entry point into your tenant.
There is no CVE attached to this one. That is the point. This was credential abuse against a trusted third party, not a software flaw you can patch away. If you use ConnectWise or any similar backup and RMM tooling that holds standing access to your tenant, treat this as an active incident until proven otherwise. Review sign-in logs, rotate any credentials tied to the integration, and confirm which service principals and app registrations hold mailbox or directory access.
Senserva's Three Free Unlimited Audits let you run a full check of your own Microsoft 365, Entra ID, Intune, and Defender configuration, which is the fastest way to see what external identities and app permissions are actually sitting in your tenant right now.
BeyondTrust zero-day exploited since August, now patched by CISA order
CVE-2026-102764, a BeyondTrust Remote Support zero-day, was covered heavily this week. SecurityWeek and The Record both attribute exploitation to a suspected Chinese espionage group, and separate reporting says attackers gained full admin access in minutes and have been doing so since August. CISA issued an alert urging organizations to patch the critical vulnerability in BeyondTrust Remote Support.
This CVE led an earlier post, but the new dated development is CISA's patching push on October 16 paired with confirmation that the flaw was live for roughly two months before disclosure. If you run BeyondTrust Remote Support, patch now and hunt for signs of root access and backdoors rather than assuming you were out of scope.
KEV adds and the exploited CVEs worth your attention
CISA added two known exploited vulnerabilities to the catalog on October 16. There were no new KEV entries dated October 19, but the active catalog still has plenty that is being used in the wild.
Among the hot movers, Ivanti Connect Secure CVE-2026-104935, an authentication bypass by spoofing with a CVSS of 8.6, is KEV listed. Several critical KEV entries are ransomware-linked and belong at the top of your queue: JetBrains TeamCity deserialization CVE-2026-63077 at CVSS 9.8, Oracle PeopleSoft PeopleTools CVE-2026-35273 at 9.8, and WebPros cPanel and WHM CVE-2026-41940 at 9.8 with an EPSS near 0.985. Ransomware linkage plus KEV listing is the line between patch eventually and patch now.
What the trusted press adds
Cyber Security News reported attackers exploiting a critical Collabora Online flaw, CVE-2026-110447, to backdoor Nextcloud servers. SecurityWeek noted Microsoft patched two dozen remote code execution flaws in Office in this cycle, so Office updates deserve a place in your rollout.
CISA also published guidance on threat actors targeting election and campaign officials, and Australia unveiled ASD Essentials as an expansion beyond the Essential Eight. On the identity side, Help Net Security made a point worth repeating: Active Directory weaknesses tend to stay open for years in small teams with only one or two admins.
Do this first
Grounded in today's facts, here is where to start:
- Investigate ConnectWise integration access to your Microsoft 365 tenant, rotate credentials, and review sign-ins and app permissions.
- Patch BeyondTrust Remote Support for CVE-2026-102764 and hunt for backdoors, since exploitation ran since August.
- Prioritize ransomware-linked KEV entries CVE-2026-63077, CVE-2026-35273, and CVE-2026-41940.
- Apply this cycle's Office RCE fixes and patch Ivanti Connect Secure for CVE-2026-104935.
- Use Senserva's free Microsoft Patch Tracker to rank your open Microsoft patches by KEV, EPSS, and ransomware linkage.
Sources
- Cyber Security News: Hackers used Compromised ConnectWise Backup Credentials to Hack 173 Microsoft 365 Accounts (2026-10-17)
- BleepingComputer: Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack (2026-10-17)
- Cyber Security News: Chinese Hackers Exploit BeyondTrust Zero-Day to Gain Root Access and Deploy Backdoors (2026-10-16)
- SecurityWeek: Chinese APT Exploited BeyondTrust Vulnerability as Zero-Day (2026-10-16)
- The Record: Suspected Chinese espionage attackers abusing BeyondTrust IT support zero-day (2026-10-16)
- Cyber Security News: BeyondTrust 0-Day Vulnerability Exploited Since August to Gain Full Admin Access in Minutes (2026-10-16)
- SecurityWeek: Microsoft Patches Two Dozen RCE Flaws in Office (2026-10-16)
- Cyber Security News: Hackers Exploit Critical Collabora Online Flaw to Backdoor Nextcloud Servers (2026-10-17)
- CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-16)
- CISA Cybersecurity Advisories: CISA Urges Patching Critical Vulnerability in BeyondTrust Remote Support (2026-10-16)
- CISA Cybersecurity Advisories: Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials (2026-10-16)
- Help Net Security: Why Active Directory weaknesses stay open for years in teams with one or two admins (2026-10-16)
Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-10-19.
Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.