If you run N-able urgently apply the latest hot fix in this thread. I just spent 3 hours helping a government office hit with ransomware via this. A ransomware group definitely has the exploit, it’s a bypass for the previously issued CVE.

Also proxy block Cloudflare Tunnels org wide.