--- title: "ConnectWise/R1Soft RCE & Supply Chain Risks" url: https://daily.dev/posts/connectwise-r1soft-rce-supply-chain-risks-mjwtulhgm source_url: https://www.huntress.com/blog/critical-vulnerability-disclosure-connectwise-r1soft-server-backup-manager-remote-code-execution-supply-chain-risks type: article source: "Huntress Blog" published: 2026-05-31T07:42:51.946Z updated: 2026-05-31T08:09:20.660Z tags: ["security", "cyber", "java"] reading_time: 10 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ConnectWise/R1Soft RCE & Supply Chain Risks **[Huntress Blog](https://daily.dev/sources/huntress-blog)** · 10 min read · 0 upvotes · 0 comments ## Summary Huntress researchers John Hammond and Caleb Stewart detail a critical authentication bypass vulnerability (CVE-2022-36537) in the ZK Java framework bundled with ConnectWise R1Soft Server Backup Manager. By chaining the auth bypass with a backdoored JDBC driver upload, attackers can achieve RCE as root on the backup server and then push arbitrary code — including Lockbit 3.0 ransomware — to all downstream registered endpoints. Over 5,000 exposed instances were found on Shodan, posing massive supply chain risk for MSPs and their SMB clients. A patch (SBM v6.16.4) was released and validated by Huntress. An update notes that by February 2023, threat actors were actively exploiting this vulnerability in the wild to deploy backdoors on hundreds of servers. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: --- Tags: [#security](https://daily.dev/tags/security), [#cyber](https://daily.dev/tags/cyber), [#java](https://daily.dev/tags/java) [View this post on daily.dev](https://daily.dev/posts/connectwise-r1soft-rce-supply-chain-risks-mjwtulhgm)