CVE-2026-84869: a ScreenConnect client bypass and the spread that followed it

On 3 September 2026, security firm ConnectWise issued a warning about a vulnerability, CVE-2026-84869, affecting their ScreenConnect client software. The advisory urged organizations to upgrade to version 26.6.5, released on 8 September, to protect against potential attacks. The Cybersecurity and Infrastructure Security Agency (CISA) acknowledged the issue, adding it to their Known Exploited Vulnerabilities catalog with remediation deadlines ranging from 10 to 14 September.

CVE-2026-84869 stems from a missing authorization check in the ScreenConnect client's file transfer functionality. This oversight enables attackers to initiate file transfers during an active remote session without proper host confirmation, directly executing malicious code on the target endpoint. The vulnerability impacts ScreenConnect clients operating below version 26.6.5, while the server itself remains unaffected.

Huntress, a cybersecurity consultancy, observed instances of unauthorized ScreenConnect installations and tampered clients, which were then used to distribute malicious VBScripts across managed networks. This behavior demonstrated a worm-like propagation pattern, taking advantage of remote monitoring and management (RMM) platforms' broad execution privileges. Organizations should audit the ScreenConnect version on every managed endpoint, rather than solely on servers, and promptly upgrade any systems below version 26.6.5.

Temporary mitigation measures include reviewing and adjusting user roles to remove unnecessary file transfer permissions. Administrators should also search for suspicious wscript.exe processes initiated by the ScreenConnect client, monitor for installations lacking change records, and compare client binaries' hashes against vendor-provided builds.

Lastly, RMM tooling should be subject to the same inventory controls as servers, as it presents an attractive target for attackers due to its privileged access within corporate environments.