The Exploit Bulletin — Sunday, October 18, 2026: 2 issues require action
Sunday, October 18, 2026 — 2 issues require action. If you run none of the software below, you are done.
Affects: ConnectWise · Broadcom
1. ConnectWise Cloud Backup app identities abused to sign into Microsoft 365 tenants
SUPPLY-CHAIN COMPROMISE · CRITICAL
A trusted multi-tenant app with mailbox- and directory-wide scopes is already being used to read customer tenant data, so any organization that ever consented to ConnectWise Cloud Backup or Cloud Management must revoke that consent and hunt its sign-in logs now rather than wait for the investigation to close.
Attackers obtained ConnectWise's Microsoft 365 application credentials and used the Cloud Backup (formerly SkyKick) service principal — which holds broad delegated access to mailboxes, OneDrive, SharePoint, Teams and directory data in every tenant where it is installed — to sign into MSP partner and end-customer tenants. ConnectWise disabled seven ConnectWise application identities and shut off customer access to Cloud Backup; Microsoft confirmed unauthorized authentication attempts from an IP address on October 15, and Huntress reported confirmed unauthorized sign-ins in 162–173 tenants.
Affected: ConnectWise Cloud Backup (formerly SkyKick Cloud Backup) — app ID 506e08f9-6e9a-4da4-942b-a099a03644ae; ConnectWise Cloud Management — app ID 2399d300-6fca-4e6a-a686-399fefe75b83; ConnectWise Cloud Management - MS Teams — app ID 24205314-2b89-4e07-a2a4-579e898a5640; ConnectWise Cloud Management - Exchange Online — app ID b78f6a77-d4e5-46fb-87e5-d1648bd02519; ConnectWise Cloud Management - MS Graph — app ID 0de14c77-b9b0-4137-9360-34878a929827; ConnectWise Cloud Management - Partner Center — app ID 412dcf96-176d-4b3a-a1b0-4981ad66971e; ConnectWise Cloud Management - SharePoint Online — app ID b2b55f5b-7758-4719-8d8f-88ae172e6bdb; Microsoft 365 tenants of ConnectWise MSP partners and their end customers
How to Test: In Entra ID, list enterprise applications and service principals for the seven ConnectWise app IDs (start with 506e08f9-6e9a-4da4-942b-a099a03644ae and 0de14c77-b9b0-4137-9360-34878a929827); then review Entra service-principal and non-interactive sign-in logs plus the Microsoft 365 unified audit log (MailItemsAccessed, FileAccessed, Add delegated permission grant, Add service principal credentials) for activity attributed to those apps from October 15, 2026 onward, and compare source IPs against the ConnectWise advisory and Microsoft indicators; presence of the app alone is not compromise — look for sign-ins and data access you did not schedule.
How to Mitigate: Revoke the OAuth consent grants and delete/disable the service principals for the seven listed ConnectWise application identities in every tenant, remove any unexpected app credentials or delegated permission grants they created, rotate ConnectWise portal and MSP admin credentials and re-enroll MFA for accounts touched by the activity, re-consent only after ConnectWise confirms the identities are clean, and preserve/export audit logs for the affected period.
Evidence: ConnectWise disables seven application identities after M365 tenant compromise · BleepingComputer: ConnectWise shuts down Cloud Backup; Microsoft confirms malicious activity · Huntress: confirmed unauthorized sign-ins in 173 partner/customer tenants
2. Unauthenticated WiFi RCE in Broadcom 802.11 WPS EAP parser (Broadcom-based routers)
UNVERIFIED PUBLIC REPORT · NO CVE · REMOTE CODE EXECUTION · CRITICAL
Public disclosure at Hexacon on 2026-10-16 with working exploit demos; Broadcom declined a CVE and devices remained unpatched as of Oct 15, 2026, so defenders must act now.
A researcher disclosed a WPS EAP reassembly overflow in Broadcom's proprietary 802.11 implementation, present since ~2010 with only an incomplete 2018 patch. It can be triggered remotely over WiFi without the network key or WPS enrollment, yielding controlled information disclosure and arbitrary code execution; the researcher demonstrated exploitation on several ISP CPE (Proximus BBOX3V+, Netgear CG3100/CG3700, Technicolor TC7210/CGA4233, ASKEY TCG3000), with video demos extracting the PSK and getting a root reverse shell over 802.11. There is no CVE (Broadcom declined to assign one) and no vendor advisory; affected device counts and the full OEM list are not fully established.
Affected: Broadcom eCos platforms BCM3380/BCM3383/BCM33834 (forever-day) and Linux platforms BCM3390/BCM65xx/BCM68xx running Broadcom's proprietary 802.11/WPS stack
How to Test: Use the researcher's fingerprinting script and YARA rule to detect the vulnerable Broadcom 802.11/WPS stack; confirm whether your access point/CPE uses an affected chipset (BCM3380/3383/33834 on eCos, or BCM3390/65xx/68xx on Linux) running Broadcom's proprietary WPS rather than hostapd.
How to Mitigate: No complete vendor fix for eCos platforms — treat as a forever-day and replace or decommission affected devices; disable WPS to reduce reachability; for Linux-based platforms request firmware that migrates to hostapd from the OEM; restrict physical RF exposure where devices cannot be replaced.
Evidence: Researcher write-up with video PoCs · CERT/CC VU#166939 Broadcom WiFi driver vulnerabilities — a separate, earlier advisory, not this WPS parser bug
Read on the web · Every past edition
The Exploit Bulletin is free and daily. It publishes only what security teams must act on today — nothing else. Forward it freely.
Spot an error, or an exploit we missed? Reply here or email [email protected].
