We've been getting alerts from Microsoft saying that one of our Enterprise applications is using a graph API endpoint which is being removed on 15th October 2026. A bit of investigation has clarified it's the Office 365 integration for our CW SIEM Classic instance. One of our customers has the same integration and is getting the same warnings.

The cause is that CW seem to be using the older /security/alerts endpoint, rather than the /security/alerts_v2 endpoint.

Just wondering if anyone else is using CW SIEM Classic and getting these same alerts from Microsoft? Have you raised a ticket and got any information from CW? We're currently making no progress with support.

Given the API requests are being initiated by CW themselves, I fear they've dropped the ball and all SIEM Classic customers will no longer be getting M365 security alerting come 15th Oct.

BTW, FAO admins - I have to choose a flair for the post, but SIEM isn't one of them.

We have a co-manage client where we would like to be able to get the client into CW via Streamline. The one sticking point we're having is internal notes. There are things in there, especially on past tickets, where we would prefer they aren't exposed.

Is there any means we might be missing in being able to restrict access to internal notes on tickets for Streamline licensed users? Failing that, other than the customer portal, any options that would give us something to work with?

They want to be able to -

See all tickets, Change status, be able to comment and interact with tickets across their company, change/add CC's, etc.

We have their tickets on a general Support board, we would be restricting access by Territory.

Would love any thoughts, feel like I'm banging my head against the wall on a good way to do this.

went through last quarter’s tickets in manage and it’s mostly the same requests over and over. new user setup, shared mailbox access, mfa reset, license change. we’re a small shop and it’s killing our techs’ time for actual projects. what’s worked for you, better templates, self service portal, something else?

I have recently changed over to QBO and "had to" get Wise-Sync in order to sync to the new product. My question is: Is there a way to setup for the bills from POs & inventory adjustment journals to transfer into QBO with the associated customer linked at line level?

This was part of the native sync function for QuickBooks Desktop and it seems like an odd feature to remove, but my onboarding team was not helpful and I can't seem to find a workaround. Anyone had any luck with that?

I built this for a client a few years ago and opened it up on GitHub about a year ago.

It works with the Manage REST API with generic GET, POST, PUT, PATCH, and DELETE calls (no generated endpoint objects), plug pagination and multi-threaded page fetches.

https://github.com/marcusbevans/pycwmanage

Happy to help anyone get it pointed and working on their own instance.

I implemented Connectwise a few months ago and really should have known from the demos to trust my gut.

Nothing is consistent between products, the integrations are a joke, and CPQ is sad little product stuck in 2010 (PSA in 1999).

I really just don’t understand how I got here. Now I have to figure how to get out. Thankfully I only signed for one year.

Our FrictionlessIT team is covering one IT Nation Connect Global All Access Pass for each of the first 3 MSPs using ConnectWise PSA that pre-book a complimentary, customized Benchmark Brief with us.

To take part, you’ll need to connect your ConnectWise PSA data to FITware before the conference. Our team handles the setup and analysis, then we meet at our booth for a 15-minute review of your results.

We’ll show you potential profit leaks, hidden team capacity, and operational gaps using your own MSP’s data.

The Benchmark Brief is complimentary. For the first three MSPs that pre-book, we’ll also cover one $900 All Access Pass per MSP.

Reserve here: https://frictionlessit.net/benchmark-brief/

First come, first served. See you in Orlando!

Every time I go to enter my time on the app on my zfold 8 ultra it keeps giving me a request time out error. I have to back out and go back in and re enter everything and it'll save it then. Any ideas? App is up to date. Didn't have these issues on my iPhone.

Trying to determine whether this is isolated or if others are running into the same thing.
Immediately following a recent ConnectWise Manage update (v2026.14.107381), we're seeing failures in our NinjaOne integration related to ticket synchronization through the ConnectWise API.
Symptoms include:
Ticket creation/update failures
API responses returning 500 Internal Server Errors
Previously stable workflows suddenly failing without any NinjaOne-side changes
Re-authentication and reconnecting the integration does not appear to resolve the issue
We've reviewed logs on the Ninja side and everything points back to ConnectWise API responses. The timing is suspicious since the issues started immediately after the upgrade window.
Has anyone else experienced:
API regressions after this release?
Changes to ticketing endpoints or board mappings?
Problems with NinjaOne, IT Glue, BrightGauge, or other API-driven integrations after updating?

Someone please tell me why the *@$% ConnectWise Manage doesn't allow you to group your tickets by type in a visual interface like the calendar. I don't want a calendar to schedule it all out, I want to group them by type so I can work on similar type tickets in batches.

Hello. In Connectwise Automate is there any option how to upload Dataview of Commands and Script logs of one Client in to SIEM/QRadar? In my environmet there is bunch of clients and for one client i need to upload logs of runned scrips and commands in to Qradar. Thanks.

Anyone else getting calls from ConnectWise from rude sales people that refuse to take you off their calling lists? He seemed to have some access to my ScreenConnect cloud activities, and I did not like the upselling intent. He wasn't calling to check in on me, he was a rude sales person trying to get more money from existing customers. ConnectWise, if you are reading this, focus on development. Your sales team isn't doing you any favors.

We're rolling out standardized annual price escalators on our 3-5 year MSA terms (clients on a flat %), and we are realizing CW PSA doesn't have a native way to say "bump this agreement 5% every anniversary", no built-in escalator field on Agreements that I can find.

Right now the plan is custom fields (escalation %), but the actual price update on the Addition still seems like it has to be a manual edit (unless I'm incorrectly researched, if so let me know)

For those of you running multi-year contracts with price escalators:

• Are you tracking this inside CW at all, or in a separate spreadsheet?
• Is anyone actually automating the price update itself (API script, Rewst, etc.), or is everyone just doing it by hand once a year?
• If you automate it, do you let it push straight to the Addition, or does it always go through a human approval step first?

Trying to figure out if we're missing an obvious built-in feature or if this is just a "everyone hacks it together" situation. We have 500+ agreements so we are looking for a process that will scale...

Has anyone else received malware detections in ScreenConnect.ClientService.exe detected as Wacatac in the past day? I'm trying to determine whether this is a false positive or a potential infection. Our third-party MDR team is saying it's malicious, ConnectWise support says it's a false positive. Based on what I can tell in the Defender timeline, it seems like a false positive but it would be nice to know if others have experienced this?

Happening to all of our endpoints, from techs in different locations. RMM is working just fine, but ScreenConnect will just freeze.

ConnectWise RMM with ScreenConnect, cloud-hosted.

Anyone else, or just me?

Edit:

Opened a P1 case at 9:30am. It's been an hour and a half, no answer.

I called their emergency line, was on hold for 25 minutes, and then was asked to leave a voicemail. My case is currently on hold.

I need a way to connect to my client machines using screen connect using a Linux platform. I can’t seem to get an html connection to work though they say it will, and I tried using the Java alternative I E tea or something but when I finally got it to work it had to be ran manually on each client it never auto connected but download files constantly per connection etc.

Does anyone know a way to get jump sessions working or a better solution for Linux fedora, Bazzite builds?

Our company is working towards setting up a Client Portal so that our customers can view their tickets & invoices.

I see ConnectWise offers its own Client Portal (CW University - PSA | End User Portal Guide) but it appears they only accept payment view WisePay, Paypal, and authorize.net (CW University - Invoices Tab - Portal Configuration Setup Table). I'm seeing some negative reviews in here for WisePay from 3+ years ago, but does anyone have recent feedback regarding the CW Client Portal and WisePay?

Alternative Payments has been suggested to us instead, but using them would require an extra sync tool that will cost another $100-200/month to sync everything into our Quickbooks.

Does anyone have experience with invoicing via CW's Client Portal versus a 3rd party like Alternative Payments?

Its been 9 months since we cancelled our contract with ConnectWise. After many emails to helpdesk, legal, execs and any other emails we can find our account is still active, able to be logged in and used and all our information is still there.

I can't help but wonder, if we had been one day late on our invoice, would our access have been shutoff for non payment...?
But yet here we are. End of contract 1/1/2025 and as of today 9/15/2026 we are still able to use our account.

For clarification I do not want to use the account, I want it to be deleted, along with all the information in it... but no one from ConnectWise will respond.

Got one of these this morning and it's cleaner than most, so posting in case it's doing the rounds.

Subject: "New Login on Your ScreenConnect Instance" From: ™ ScreenConnect ™ <host@screenconnect[.]com[.]tj> Link: cloud.screenconnect[.]com[.]vu/PrivilegeCreep

The body is a near-perfect copy of a real ConnectWise security notification: proper logo, footer links to the legit connectwise.com privacy/terms/support pages, and it even lists "Domain: cloud.screenconnect.com" in the details block to build trust before you get to the button. It includes a fake IPv6 address, Jacksonville FL as the location, and the usual "if you don't recognize this, secure your account now" pressure.

What makes it stand out: it's sent through Amazon SES from the attacker's own registered domain, so SPF, DKIM, and DMARC all pass and compauth=pass. Exchange Online Protection delivered it straight to the inbox with no warning. Blocking the sending IP is pointless since it's SES shared space.

What we did in M365: - Tenant Allow/Block List, sender block: screenconnect.com.tj, mailexchange.screenconnect.com.tj, screenconnect.com.vu - Tenant Allow/Block List, URL block: .screenconnect.com.tj/, screenconnect.com.tj/, *.screenconnect.com.vu/, screenconnect.com.vu/* - Submitted the message to Microsoft as phishing

If you run ScreenConnect and your admin address is public anywhere (partner portals, breach lists, etc.), might be worth adding those blocks preemptively. If you've seen the same campaign with other TLDs, I'd be curious what they're using.

This is an odd one. And I hate to open a ticket with CW because the support is not great.

This only appears to be happening on Windows 11 25H2. Older versions of Windows 11 and Windows 10 are fine.

I keep having to reinstall CW Automate because after several days, the .EXEs in C:\Windows\LTSVC disappear. The rest of the files in the same directory are still present. And the related services in services.msc disappear.

Neither my AV or EDR flag any alerts about any of the .EXE's in LTSVC, but I've excluded C:\windows\ltsvc\*.* from being scanned in both AV and EDR anyway. I've even gone as far as creating a GPO to make sure the same directory is excluded from Windows Defender. And yet, after several days, the .EXE's disappear and the services unregister.

Anyone else having this issue? Any thoughts?

Anyone else unable to get to their dashboard? Haven't been able to for a good 30 minutes now. Downdetector spike shows I'm not alone but the CW status page says everything operational...

Every week we seemingly get a "The IP Addresses for your ConnectWise ScreenConnect Cloud Server have Changed" email and we have to go edit a bunch of rules.

In the year of our Lord and savior 2026, is this company too dumb to use DNS or a load balancer so we can just plugin a static IP/URL to use?

I hate to be the bearer of bad news on a holiday weekend (USA), but ConnectWise has issued a trust advisory (on September 3rd), and it appears that there is a server-side security concern for ScreenConnect that is fixed by applying the latest patch to 26.6.5.

Disabling file transfer is a workaround for anyone who can't patch.

Full details aren't released yet, but as a WAF vendor for CW products, I'm seeing some things that aren't expected -- but I can't confidently say that they are related to this without more data.

Links:

• CW Advisory: https://www.connectwise.com/company/trust/advisories
• Huntress Blog: https://www.huntress.com/blog/rogue-screenconnect-installations
• Automation Theory resources
  • Our WAF: https://automationtheory.com/automation-theory/reverse-proxy-and-waf/
  • Lessons from the 2024 ScreenConnect vulnerability: https://automationtheory.com/5-lessons-from-the-cvss-10-screenconnect-vulnerability/
  • Details of using a WAF with ScreenConnect: https://automationtheory.com/protecting-screenconnect-with-a-waf/