IT solution provider ConnectWise has patched a critical remote code execution (RCE) vulnerability in their ConnectWise Recover and R1Soft Server Backup Manager (SBM) secure backup solutions. If successfully exploited, threat actors could execute arbitrary code within the vulnerable environment, as well as pilfer sensitive information. The flaw is described as an Improper Neutralization of Special Elements in Output Used by a Downstream Component vulnerability. This type of vulnerability occurs when the affected software constructs a command utilizing external user-supplied inputs from an upstream component, but the software fails to neutralize special elements which can modify how the command is processed and interpreted when it’s sent back to a downstream component. The R1Soft SBM backup solution is a very popular tool utilized by cloud hosting providers and managed service providers. According to a Shodan scan, more than 4,800 R1Soft servers are exposed to the internet and may be vulnerable to attacks if they haven’t been patched. CTIX analysts recommend that ConnectWise users ensure their instances of Recover SBM have been automatically updated to v2.9.9, and R1Soft users should upgrade to SBM v6.16.4 immediately.