RMM Vulnerabilities and Remote Access Flaws: Gateways Are Exploited Within Days, and Remote Support Tools Feed Ransomware
RMM vulnerabilities, remote support flaws, and VPN gateway bugs are often discussed as one risk to managed service providers. The exploitation record shows three different patterns. We matched every entry in CISA’s Known Exploited Vulnerabilities catalog to its NVD record, classified the 152 entries in these three tool groups with fixed rules, and tested each group against the rest of the catalog.
Version 1.0 · Published October 19, 2026 · Data as of KEV catalog 2026.10.16
Key findings
- CISA’s Known Exploited Vulnerabilities (KEV) catalog lists 152 exploited flaws in three parts of the MSP toolchain: 79 in VPN and remote access gateways, 60 in RMM and IT management tools, and 13 in remote support software (catalog version 2026.10.16).
- Gateways are exploited fastest. For CVEs published since 2022, VPN and remote access gateway flaws reached KEV a median 1 day after NVD publication, against 8 days for the rest of the catalog (Mann-Whitney U, p < 0.001; n = 45 vs 741), and 73% were listed within a week.
- Gateways and remote support tools feed ransomware. 53% of post-2022 gateway entries and 50% of remote support entries are flagged by CISA as used in ransomware, against 16% for the rest of KEV (odds ratios 6.0 and 5.3; Fisher exact p < 0.001 and p = 0.007; remote support n = 12).
- RMM and IT management tools are not exploited faster than average. Their median was 6 days (p = 0.559) and 19% are ransomware-linked (p = 0.669), both in line with the rest of the catalog.
- But RMM and IT management entries are accumulating: 15 were added in 2026, the most in any year, and the group is the largest by vendor count (14 vendors).
- Remote support software has 13 KEV entries, 7 of them added in 2026; the count is small, so year-to-year changes should be read with caution.
Every exploited remote access and management flaw
known ransomware use no known ransomware use · one dot per KEV entry, by date added
| Tool group | KEV entries | Median days to KEV* | Within 7 days* | Ransomware-linked* | Median CVSS | Top vendors (entries) |
|---|---|---|---|---|---|---|
| Remote support software | 13 | 22 (p = 0.883) | 42% | 50% (p = 0.007) | 9.8 | BeyondTrust (4), ConnectWise (4), SimpleHelp (4), TeamViewer (1) |
| RMM and IT management | 60 | 6 (p = 0.559) | 53% | 19% (p = 0.669) | 9.8 | Ivanti (19), Zoho (9), SolarWinds (7), N-able (5) |
| VPN and remote access gateways | 79 | 1 (p < 0.001) | 73% | 53% (p < 0.001) | 8.8 | Ivanti (16), Cisco (15), SonicWall (14), Citrix (12) |
| Rest of KEV (comparison) | 1596 | 8 | 49% | 16% | 8.8 |
*CVEs published from January 2022; p values compare each group with the rest of KEV.
How fast each group is exploited
We measured the days between a CVE’s publication in the National Vulnerability Database and its addition to KEV, which CISA makes only after it has reliable evidence of exploitation. To avoid the backlog of old CVEs CISA loaded when KEV launched in November 2021, the comparison uses only CVEs published from January 2022. On that basis, gateway flaws reached KEV a median 1 day after publication against 8 days for the rest of the catalog, and 4 of 45 were listed before NVD published its record at all. RMM and IT management tools (6 days) and remote support software (22 days) were not faster than the rest of the catalog.
RMM and remote support entries
The 73 entries below are the tools an MSP itself runs to manage clients, newest first. Days is the time from NVD publication to KEV addition.
| CVE | Product | Added to KEV | Days | CVSS | Ransomware |
|---|---|---|---|---|---|
CVE-2026-102764 |
BeyondTrust Remote Support | 2026-10-16 | 1 | 9.8 | |
CVE-2026-84869 |
ConnectWise ScreenConnect | 2026-09-11 | 3 | 9.9 | |
CVE-2026-86218 |
N-able N-central | 2026-09-08 | 2 | 9.8 | |
CVE-2026-18556 |
N-able N-central | 2026-08-04 | 3 | 7.4 | |
CVE-2026-18577 |
N-able N-central | 2026-08-03 | 1 | 8.1 | |
CVE-2026-48558 |
SimpleHelp SimpleHelp | 2026-06-29 | 17 | 10.0 | |
CVE-2026-6973 |
Ivanti Endpoint Manager Mobile (EPMM) | 2026-05-07 | 0 | 7.2 | |
CVE-2024-1708 |
ConnectWise ScreenConnect | 2026-04-28 | 797 | 8.4 | Yes |
CVE-2024-57728 |
SimpleHelp SimpleHelp | 2026-04-24 | 464 | 7.2 | Yes |
CVE-2024-57726 |
SimpleHelp SimpleHelp | 2026-04-24 | 464 | 9.9 | Yes |
CVE-2025-32975 |
Quest KACE Systems Management Appliance (SMA) | 2026-04-20 | 300 | 10.0 | |
CVE-2026-21643 |
Fortinet FortiClient EMS | 2026-04-13 | 66 | 9.8 | |
CVE-2026-1340 |
Ivanti Endpoint Manager Mobile (EPMM) | 2026-04-08 | 69 | 9.8 | |
CVE-2026-35616 |
Fortinet FortiClient EMS | 2026-04-06 | 2 | 9.8 | |
CVE-2021-22054 |
Omnissa Workspace One UEM | 2026-03-09 | 1543 | 7.5 | |
CVE-2025-26399 |
SolarWinds Web Help Desk | 2026-03-09 | 167 | 9.8 | Yes |
CVE-2026-1603 |
Ivanti Endpoint Manager (EPM) | 2026-03-09 | 27 | 8.6 | |
CVE-2026-1731 |
BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) | 2026-02-13 | 7 | 9.8 | Yes |
CVE-2024-43468 |
Microsoft Configuration Manager | 2026-02-12 | 492 | 9.8 | |
CVE-2025-40536 |
SolarWinds Web Help Desk | 2026-02-12 | 15 | 8.1 | |
CVE-2025-40551 |
SolarWinds Web Help Desk | 2026-02-03 | 6 | 9.8 | |
CVE-2026-1281 |
Ivanti Endpoint Manager Mobile (EPMM) | 2026-01-29 | 0 | 9.8 | |
CVE-2025-61932 |
Motex LANSCOPE Endpoint Manager | 2025-10-22 | 2 | 9.8 | |
CVE-2025-8876 |
N-able N-Central | 2025-08-13 | -1 | 8.8 | |
CVE-2025-8875 |
N-able N-Central | 2025-08-13 | -1 | 7.8 | |
CVE-2025-2775 |
SysAid SysAid On-Prem | 2025-07-22 | 76 | 9.3 | |
CVE-2025-2776 |
SysAid SysAid On-Prem | 2025-07-22 | 76 | 9.3 | |
CVE-2025-3935 |
ConnectWise ScreenConnect | 2025-06-02 | 38 | 8.1 | |
CVE-2025-4428 |
Ivanti Endpoint Manager Mobile (EPMM) | 2025-05-19 | 6 | 7.2 | |
CVE-2025-4427 |
Ivanti Endpoint Manager Mobile (EPMM) | 2025-05-19 | 6 | 5.3 | |
CVE-2024-13161 |
Ivanti Endpoint Manager (EPM) | 2025-03-10 | 55 | 9.8 | |
CVE-2024-13160 |
Ivanti Endpoint Manager (EPM) | 2025-03-10 | 55 | 9.8 | |
CVE-2024-13159 |
Ivanti Endpoint Manager (EPM) | 2025-03-10 | 55 | 9.8 | |
CVE-2024-4885 |
Progress WhatsUp Gold | 2025-03-03 | 251 | 9.8 | |
CVE-2024-57727 |
SimpleHelp SimpleHelp | 2025-02-13 | 29 | 7.5 | Yes |
CVE-2018-19410 |
Paessler PRTG Network Monitor | 2025-02-04 | 2267 | 9.8 | |
CVE-2018-9276 |
Paessler PRTG Network Monitor | 2025-02-04 | 2409 | 7.2 | |
CVE-2024-12686 |
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) | 2025-01-13 | 26 | 6.6 | |
CVE-2024-12356 |
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) | 2024-12-19 | 2 | 9.8 | |
CVE-2024-47575 |
Fortinet FortiManager | 2024-10-23 | 0 | 9.8 | |
CVE-2024-28987 |
SolarWinds Web Help Desk | 2024-10-15 | 55 | 9.1 | |
CVE-2024-9380 |
Ivanti Cloud Services Appliance (CSA) | 2024-10-09 | 1 | 7.2 | |
CVE-2024-9379 |
Ivanti Cloud Services Appliance (CSA) | 2024-10-09 | 1 | 6.5 | |
CVE-2024-29824 |
Ivanti Endpoint Manager (EPM) | 2024-10-02 | 124 | 8.8 | |
CVE-2024-8963 |
Ivanti Cloud Services Appliance (CSA) | 2024-09-19 | 0 | 9.4 | |
CVE-2024-6670 |
Progress WhatsUp Gold | 2024-09-16 | 18 | 9.8 | Yes |
CVE-2024-8190 |
Ivanti Cloud Services Appliance | 2024-09-13 | 3 | 7.2 | |
CVE-2024-28986 |
SolarWinds Web Help Desk | 2024-08-15 | 2 | 9.8 | |
CVE-2021-44529 |
Ivanti Endpoint Manager Cloud Service Appliance (EPM CSA) | 2024-03-25 | 838 | 9.8 | Yes |
CVE-2023-48788 |
Fortinet FortiClient EMS | 2024-03-25 | 13 | 9.8 | Yes |
CVE-2024-1709 |
ConnectWise ScreenConnect | 2024-02-22 | 1 | 10.0 | Yes |
CVE-2023-35082 |
Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core | 2024-01-18 | 156 | 9.8 | Yes |
CVE-2023-47246 |
SysAid SysAid Server | 2023-11-13 | 3 | 9.8 | Yes |
CVE-2023-35081 |
Ivanti Endpoint Manager Mobile (EPMM) | 2023-07-31 | -3 | 7.2 | |
CVE-2023-35078 |
Ivanti Endpoint Manager Mobile (EPMM) | 2023-07-25 | 0 | 9.8 | Yes |
CVE-2022-28810 |
Zoho ManageEngine | 2023-03-07 | 323 | 6.8 | |
CVE-2022-47966 |
Zoho ManageEngine | 2023-01-23 | 5 | 9.8 | Yes |
CVE-2022-35405 |
Zoho ManageEngine | 2022-09-22 | 65 | 9.8 | |
CVE-2017-18362 |
Kaseya Virtual System/Server Administrator (VSA) | 2022-05-24 | 1204 | 9.8 | Yes |
CVE-2022-22954 |
VMware Workspace ONE Access and Identity Manager | 2022-04-14 | 3 | 9.8 | Yes |
CVE-2018-20753 |
Kaseya Virtual System/Server Administrator (VSA) | 2022-04-13 | 1163 | 9.8 | Yes |
CVE-2018-11138 |
Quest KACE System Management Appliance | 2022-03-25 | 1394 | 9.8 | Yes |
CVE-2021-44515 |
Zoho Desktop Central | 2021-12-10 | -2 | 9.8 | |
CVE-2021-37415 |
Zoho ManageEngine ServiceDesk Plus (SDP) | 2021-12-01 | 91 | 9.8 | |
CVE-2021-44077 |
Zoho ManageEngine ServiceDesk Plus (SDP) / SupportCenter Plus | 2021-12-01 | 2 | 9.8 | |
CVE-2019-18988 |
TeamViewer Desktop | 2021-11-03 | 635 | 7.0 | |
CVE-2020-15505 |
Ivanti MobileIron Multiple Products | 2021-11-03 | 484 | 9.8 | |
CVE-2021-30116 |
Kaseya Virtual System/Server Administrator (VSA) | 2021-11-03 | 117 | 10.0 | Yes |
CVE-2020-10148 |
SolarWinds Orion | 2021-11-03 | 309 | 9.8 | |
CVE-2016-3643 |
SolarWinds Virtualization Manager | 2021-11-03 | 1965 | 7.8 | |
CVE-2021-40539 |
Zoho ManageEngine | 2021-11-03 | 57 | 9.8 | Yes |
CVE-2020-10189 |
Zoho ManageEngine | 2021-11-03 | 607 | 9.8 | |
CVE-2019-8394 |
Zoho ManageEngine | 2021-11-03 | 990 | 6.5 |
What this means for MSPs and MSSPs
The three groups call for different responses. Internet-facing gateways are exploited within days of disclosure, which leaves no room for a monthly patch cycle. Remote support tools are not exploited unusually fast, but when they are, CISA frequently links the activity to ransomware. RMM and IT management tools look average on both measures, yet the number of exploited entries keeps rising, so they belong in the same advisory-watch process as the rest of the stack.
Frequently asked questions
Which RMM and IT management tools have known exploited vulnerabilities?
As of KEV catalog version 2026.10.16, by number of KEV entries: Ivanti (19), Zoho (9), SolarWinds (7), N-able (5), Fortinet (4), SysAid (3), Kaseya (3), Quest (2), Progress (2). Remote support software: BeyondTrust (4), ConnectWise (4), SimpleHelp (4), TeamViewer (1). AnyDesk, Splashtop, NinjaOne, Datto, Atera, LogMeIn, GoTo had no KEV entries at that date.
How fast are RMM vulnerabilities exploited?
For CVEs published since 2022, RMM and IT management flaws reached KEV a median 6 days after NVD publication, which is not statistically different from the 8-day median for the rest of the catalog. VPN and remote access gateways are the fast group, at 1 day.
Are remote support tools used in ransomware?
Disproportionately. CISA flags 6 of the 13 remote support software entries as used in ransomware campaigns, including entries for ScreenConnect, SimpleHelp, and BeyondTrust.
Is ScreenConnect in the KEV catalog?
Yes. ConnectWise ScreenConnect has 4 KEV entries, including the February 2024 authentication bypass CVE-2024-1709, which CISA flags as used in ransomware.
What should an MSP do about these findings?
Patch internet-facing VPN and remote access gateways as soon as a fix is available rather than in the monthly cycle, keep remote support tools on current versions with access limited by MFA and IP allow-listing, and remove remote tools that are no longer used from client endpoints.
Data dictionary (9 fields)
cve |
CVE identifier |
tool_group |
Remote support software, RMM and IT management, VPN and remote access gateways, or blank for other KEV entries |
vendor / product |
As listed in KEV |
kev_date_added |
Date CISA added the CVE to KEV |
nvd_published |
Date the CVE record was published in NVD |
days_to_kev |
kev_date_added minus nvd_published; negative means KEV listed it first |
ransomware_known |
CISA knownRansomwareCampaignUse = Known |
cvss_v3 |
NVD primary or CNA CVSS v3.x base score |
cwe |
First CWE listed in NVD |
Methodology
Sources. CISA Known Exploited Vulnerabilities catalog, JSON feed, version 2026.10.16 (1,748 entries). NIST NVD CVE API 2.0, query hasKev, retrieved October 19, 2026, joined on CVE ID.
Classification. Entries were assigned to a tool group by vendor and product name with fixed rules: remote support software (for example ScreenConnect, SimpleHelp, BeyondTrust Remote Support); RMM and IT management, meaning remote monitoring, endpoint and mobile device management, help desk, and network monitoring tools (for example Kaseya VSA, N-able N-central, Ivanti Endpoint Manager and EPMM, ManageEngine, SolarWinds Web Help Desk and Orion, SysAid, Quest KACE, Paessler PRTG, Microsoft Configuration Manager, Omnissa Workspace ONE UEM); VPN and remote access gateways (Ivanti Connect Secure, Pulse, and Sentry, Citrix NetScaler Gateway and ADC, SonicWall SMA, Array Networks AG, F5 BIG-IP APM, and firewall entries from Fortinet, Palo Alto Networks, Cisco, SonicWall, Check Point, Zyxel, WatchGuard, and F5 whose KEV description names a VPN, remote access, or IKE component). SD-WAN-only, file transfer, auditing, and print management products, and operating-system services such as Remote Desktop Services, were excluded. The complete classification is in the dataset.
Statistics. Days-to-KEV compared with a one-sided Mann-Whitney U test; proportions with Fisher’s exact test (two-sided). Each group is compared with all KEV entries outside the three groups, restricted to CVEs published from January 1, 2022 (n = 45 gateways, 43 RMM and IT management, 12 remote support, 741 rest of KEV). Remote support results rest on a small sample.
Limitations. KEV records confirmed exploitation known to CISA, not all exploitation. The ransomware flag can be updated after an entry is added, so recent entries may be under-flagged. NVD publication is a proxy for public disclosure; a vendor advisory can precede it.
Not advice. This is an analysis of public vulnerability records, not a security assessment.
Cite as:The Uptime Report. "RMM Vulnerabilities and Remote Access Flaws: Gateways Are Exploited Within Days, and Remote Support Tools Feed Ransomware." October 2026. https://theuptimereport.com/rmm-vulnerabilities/
References
- CISA, Known Exploited Vulnerabilities Catalog. Version 2026.10.16.
- NIST, NVD CVE API 2.0. Accessed October 19, 2026.
- CISA, KEV addition of ConnectWise ScreenConnect CVE-2024-1709.
Research library
More original data reports from The Uptime Report. Every report includes its methodology and a free CSV download. Browse all research
Threats and breaches
- Hypervisor Vulnerabilities
Exploitation by hypervisor, NVD and KEV - DMARC Adoption Statistics 2026
Our scan of 15,000 domains - VPN Vulnerabilities by Vendor
VPN gateway KEV and CVEs by vendor - MFA Statistics 2026
MFA methods across 2,571 services - Password Statistics 2026
12,674 passwords tested against HIBP - Ransomware Groups 2026
Most active ransomware groups, ranked - Ransomware Statistics 2026
Leak-site victims by month since 2021 - Malicious npm Packages
Malicious npm packages, day by day - Cybersecurity Statistics 2026
70 sourced stats, every number traced - Zero-Day Statistics
Every tracked zero-day since 2014 - Phishing Statistics 2026
Four phishing measures, one evidence board - Patch Tuesday Statistics 2026
Every Microsoft CVE since 2021 - Disaster Declarations by State
FEMA data for continuity planning - Data Breach Statistics 2026
980 breaches in Have I Been Pwned - Ransomware Initial Access Vectors
CISA advisories coded by entry technique - CVE Statistics 2026
Vulnerabilities published per year, NIST NVD - How Long Do Companies Take to Report a Data Breach?
1,675 Washington notices - Known Exploited Vulnerabilities
The CISA KEV catalog analyzed - Healthcare Data Breach Report 2026
HHS OCR breach portal scorecard - Ransomware Reported to the FBI
Five-year IC3 trend
Infrastructure and uptime
- Domain Name Statistics 2026
Domains by TLD, renewals, registrars - Linux Market Share 2026
Linux desktop share, every headline traced - GitHub Outages
GitHub incidents by month since 2020 - Cloudflare Outage History
Every Cloudflare outage post-mortem - Starlink Statistics 2026
Satellites, subscribers, coverage, outages - Internet Access Statistics 2026
Home internet gaps by state and group - SQL Server End of Life
SQL Server support countdown + CVEs - Windows 11 Market Share 2026
Windows 10 vs 11 share by country - Cloud Computing Statistics 2026
Hyperscaler revenue and capex, SEC data - AWS Outage History
Every AWS Post-Event Summary since 2011 - Data Centers by State 2026
Sites, jobs, power for every state - Data Center Statistics 2026
Data center power, spending, jobs - 99.9% Uptime
Uptime calculator and 35 real SLAs - Power Outage Statistics by State
Outage hours by state, EIA data - Cost of Downtime
Revenue per hour for 3,001 public companies - Windows Server End of Life
Support dates and CVEs per server version
Regulation and disclosure
- FedRAMP Statistics 2026
Authorizations, reuse, and 3PAO market - Item 1C Cybersecurity Disclosures
Coded 10-K Item 1C sample - CMMC Certification Statistics 2026
CMMC demand vs assessor capacity - Data Brokers List 2026
728 brokers across three state registries - SEC Cybersecurity Incident Disclosures
Every 8-K Item 1.05 filing - HIPAA Enforcement Tracker
Every OCR penalty and settlement
Workforce and pay
- H-1B Statistics 2026
H-1B lottery, employers, and wages - AI Layoffs 2026
AI-blamed job cuts, sourced to filings - Help Desk Salary 2026
Help desk hourly pay, BLS OEWS - Cybersecurity Salary 2026
Security pay percentiles, BLS OEWS - Women in Tech Statistics 2026
Women’s share of tech jobs since 2011 - IT Unemployment Rate 2026
Tech vs national jobless rate, monthly - Tech Job Postings 2026
Tech postings vs 2020, by role and country - Tech Layoffs 2026
Tech layoffs from state WARN notices - Remote Work Statistics 2026
Telework by job, industry, and state - Highest Paying Cities for IT Jobs 2026
Metro pay by role, BLS OEWS - The Tech Job Market in 2026
Openings, quits, hires, layoffs - IT Salaries by State 2026
Pay matrix for four IT roles - IT and Cybersecurity Jobs Outlook 2026
BLS employment projections
MSP market and spending
- MSP Market Size 2026
Managed services market, built from Census - Small Business AI Adoption 2026
AI use by firm size, sector, state, Census - Cyber Insurance Statistics
Cyber insurance market, NAIC 2015-2024 - IT Spending by Industry
IT investment by industry, BEA - IT Services Industry Growth 2026
Census revenue by service industry - IT Hourly Rates 2026
Hourly IT labor rates, GSA contracts - VoIP Statistics 2026
Business VoIP vs landlines, FCC - MSP Industry Statistics 2026
Jobs, wages, and firms, BLS QCEW - Federal IT Spending 2026
IT services contracts, USAspending - IT Services Firms by State
Census business patterns atlas
Leave a Reply