Your MSP's Remote Access Tool Is Being Weaponised: What UK Small Businesses Need to Know Now
Three vulnerabilities broke into the news cycle on the 12th and 13th of November 2026 that UK small business owners genuinely need to understand. Not because they are technically exotic, but because two of them directly target the infrastructure that small businesses rely on without thinking about it: the remote access tools your IT provider uses, and the network-attached storage device sitting in your server room or home office.
The third is a perfect-score router vulnerability with publicly available exploit code and no patch from the vendor.
Take each in turn.
Story One: The Tool Your IT Provider Uses to Fix Your Computers Is Being Weaponised
ConnectWise ScreenConnect is remote access software. It is the thing that lets your managed service provider (MSP) connect to your computer without being in the room. When something breaks, your IT person opens a ScreenConnect session, takes control of your screen, and fixes it. It is genuinely useful. It is also, right now, under active attack.
Malware called SCKit is exploiting CVE-2026-84869, a critical flaw in ScreenConnect deployments. The flaw is patched, which means the right response from any MSP is to have applied the update. The problem, as is almost always the case, is that not every MSP has done so.
The mechanics matter here. SCKit does not just compromise one machine. It targets ScreenConnect specifically because of what that software does: it has authorised access to multiple client environments. An attacker who gets into an MSP’s ScreenConnect deployment does not stop at the MSP. They pivot. Every business the MSP manages becomes a potential target, all through the same trusted connection that your IT provider uses legitimately every day.
This is a supply chain attack. The vector is trust: the implicit trust your business places in your IT provider’s tooling and patch discipline.
What this means in practice. If your MSP uses ScreenConnect and has not patched CVE-2026-84869, the malware can hijack active technician sessions. It can use those sessions to move laterally across your network, the same way a legitimate technician would, except the person at the controls is not your IT provider.
The fact that the flaw is patched is not reassuring on its own. The question is whether your specific MSP has applied the patch. Many have not.
Story Two: Synology NAS Devices Have a Critical Authentication Flaw
Synology DiskStation Manager (DSM) is the operating system that runs Synology’s network-attached storage devices. These NAS devices are common in UK small businesses: they provide centralised file storage, backup targets, and sometimes media streaming. Many are exposed to the internet either deliberately (for remote access) or inadvertently (because someone enabled a feature without understanding the implications).
CVE-2026-76954 is a SQL injection vulnerability in the Auth API of Synology DSM. It carries a CVSS score of 9.8. The vulnerability allows remote attackers to read or write arbitrary files and conduct denial-of-service attacks, without valid credentials. The attack surface is the authentication layer itself, which is about as bad a place as you can find a vulnerability.
Affected versions include DSM before 7.2.1-69057-13, before 7.2.2-72806-10, before 7.3.2-86009-5, and before 7.4.1-90080-1. Synology has released patches across all affected branches.
What this means in practice. If your Synology NAS is running an older version of DSM and is reachable from the internet, an attacker can read your files, overwrite them, or take the device offline, without needing a username or password. This is not a theoretical risk. SQL injection flaws in authentication layers are well understood by attackers and are actively scanned for.
If your Synology NAS contains client data, financial records, HR files, or anything subject to UK GDPR obligations, a successful exploit is a notifiable data breach. The ICO’s clock starts ticking from the moment you become aware of a breach, not from the moment you patch.
Story Three: A Perfect-Score Router Vulnerability with No Vendor Patch
CVE-2026-127275 affects the Linksys EA8100 router at firmware version 1.0.3.216940. It carries a CVSS score of 10.0, the maximum possible. The vulnerability is in the JNAP API, specifically in the SetRemoteSetting and SetUnsecuredWiFiWarning functions. An unauthenticated remote attacker can manipulate these functions to disable authentication on the device entirely. Public exploit code is available.
The vendor was notified prior to public disclosure. The vendor did not respond.
A CVSS 10.0 means the vulnerability is remotely exploitable, requires no authentication, requires no user interaction, and results in complete compromise of the affected component. The public exploit code removes the barrier to entry that would otherwise require attacker sophistication.
What this means in practice. If you or your staff use a Linksys EA8100 router, particularly in a home office environment, that router can be compromised remotely without any action on your part. An attacker who controls your router controls your network traffic. They can intercept unencrypted communications, redirect DNS queries, and position themselves to attack devices on the same network segment.
Home office routers are frequently overlooked in security reviews. They are not managed by IT providers in the same way as corporate equipment, they are rarely updated, and they often operate for years on the same firmware version the owner installed when they set the device up.
The Connecting Thread: Patch Discipline and Supplier Accountability
These three stories share a common thread. In each case, the vulnerability is known. In each case, the fix either exists (Synology, ScreenConnect) or requires a device replacement decision (Linksys, where the vendor has not responded). The gap between known vulnerability and actual remediation is where the damage happens.
For UK small businesses, the uncomfortable reality is this: your exposure is partly determined by your own patch discipline, and partly by your suppliers’. SCKit spreads through MSP infrastructure. A Synology NAS that your MSP monitors but has not updated is still your problem when the data breach notification has to go to the ICO.
The Linksys situation illustrates a different failure mode: a vendor that simply does not respond to a maximum-severity vulnerability disclosure. That is not acceptable behaviour from a hardware supplier, and it is worth factoring into purchasing decisions going forward.
Why This Gives You an Edge
Businesses that ask their suppliers hard questions about patching and tool versions are in a materially better position than those that do not. This is not abstract. If you can tell a prospective client that you actively monitor your MSP’s patch status and conduct quarterly reviews of internet-facing devices, that is a verifiable security posture, not a marketing claim.
Supply chain security is increasingly a procurement question. The National Cyber Security Centre’s guidance on supply chain security is explicit: organisations are responsible for understanding the security practices of their suppliers. Knowing that your MSP runs patched versions of their remote access tooling is part of that due diligence.
For businesses pursuing Cyber Essentials or Cyber Essentials Plus, the patch management requirement applies to software used to manage your environment, not just software running on your own machines. An MSP running unpatched ScreenConnect against your infrastructure is a Cyber Essentials issue.
Making the Business Case
Three points worth raising at board or management level:
Supply chain breaches carry the same legal exposure as direct breaches. Under UK GDPR, it does not matter whether the attacker entered your environment directly or through a compromised supplier. If personal data is exfiltrated, the obligation to notify the ICO within 72 hours applies. The fine exposure is identical.
Patch lag is measurable and therefore manageable. You can ask your MSP, today, how quickly they apply critical security patches to their own infrastructure. A reasonable answer is within 24 to 48 hours for CVSS 9.0 and above. If they cannot answer, or if the answer is longer than a week, that is a risk you need to document.
Unpatched internet-facing devices are the most common initial access vector. The NCSC’s annual Cyber Threat Report consistently identifies unpatched public-facing services as a leading cause of compromise in UK organisations. All three vulnerabilities this week are remotely exploitable. None require the attacker to be inside your network first.
What to Do Before the End of This Week
1. Contact your MSP and ask a specific question. Ask them: what version of ConnectWise ScreenConnect are you currently running, and when did you last apply a critical security update to your remote management tooling? The question itself sends a signal. The answer tells you something real about their patch discipline.
2. Check your Synology DSM version. Log into your NAS web interface, go to Control Panel, then Info Center, and look at the DSM version number. Cross-reference it against the patched versions listed above. If you are running DSM 7.2.1 below build 69057-13, DSM 7.2.2 below build 72806-10, DSM 7.3.2 below build 86009-5, or DSM 7.4.1 below build 90080-1, update immediately. Synology’s update mechanism is built into the DSM interface: Control Panel, Update and Restore, DSM Update.
3. Identify whether any Linksys EA8100 routers are in use. This includes home offices where staff work remotely. If you find one, the practical options are limited: the vendor has not issued a patch and has not responded to disclosure. The risk-based decision is to replace the device with hardware that receives active security support.
4. Audit which of your systems are reachable from the internet. This does not require specialist tooling. A free Shodan search for your public IP address will show you what is exposed. If you see a Synology DSM login page or any management interface, ask why it is accessible publicly and whether that access is necessary.
5. Review your MSP contract for patch obligations. Specifically look for language around how quickly they apply security updates to their own infrastructure and tools. If the contract is silent on this, raise it at your next review. It is a reasonable commercial expectation, not an unreasonable demand.
If this episode was useful, the best thing you can do is follow the show wherever you listen. If you have five minutes, a rating or a review makes a genuine difference to how the podcast reaches other business owners who need this information. Drop a comment with your thoughts, and if you know someone running a Synology NAS or working with an MSP who might not be asking the right questions, send this to them. That is exactly who we made it for.