ScreenConnect hit KEV again — the MSP insurer checklist that isn’t panic

ConnectWise ScreenConnect was added again to CISA’s Known Exploited Vulnerabilities catalog (~September 11, 2026), with vendor guidance around September 8. That is a checklist cue for anyone living in remote access — not a reason to invent exploit theater on a sales call or a blog.

Operators already know the drill. October is the month to prove it for the book of business and for the insurer questionnaire that will ask anyway.

Four checks (same every client)

1. Patch / verify version — Know the version on consoles that touch the book. Screenshot or export. Date it.
2. MFA on the console — Enforced, not “available.”
3. Session and file-transfer permissions — Review who can do what; remove leftovers.
4. Evidence next to the “yes” — When the application asks about remote-access hygiene, attach proof.

If discovery ends with “we’re fine, we patched,” you found a claim. Ask for version + evidence.

What not to do

• Do not lead with scare headlines or banned breach statistics.
• Do not imply a single CVE requires a new war room every time.
• Do not skip the habit once the news cycle moves on.

Cite KEV and the vendor bulletin as the reason to open the checklist — then talk process.

Book-of-business habit

MSPs win when the same four checks run across clients without heroics. One remote-access hygiene card. Per-client evidence links. Owner named. Review cadence on the calendar.

Re-verify current KEV entry and vendor bulletin URLs before you ship any dated claim in production copy.

Free Risk Snapshot (through Oct 31)

Want a one-page view of remote-access and related gaps — plus three next moves? Claim a Free Risk Snapshot at https://scarletrisk.com/risk-snapshot. Through October 31 only. About three minutes. No sales call required.

If you’d rather talk through your remote-access checklist with another operator, book a short call with Pete: https://calendly.com/pete-scarletrisk/30min. Checklist talk, not scare talk.