CVE-2026-84869: a ScreenConnect client bypass and the spread that followed it

CVE-2026-84869: the ScreenConnect client flaw and the worm-like spread that followed

ConnectWise published an advisory for CVE-2026-84869 on 3 September 2026 and shipped the fix in ScreenConnect 26.6.5 on 8 September. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog, with some listings showing 10 or 11 September and others 12 September, and set a remediation deadline of 14 September.

What the missing authorization check allows

The flaw is a missing authorization check (CWE-269, CWE-862) in the ScreenConnect client file transfer handling. Inside an active remote session, a file transfer started from the technician side can bypass the Host confirmation step and execute directly on the endpoint. ConnectWise rates the issue 9.9. The affected component is the client at versions below 26.6.5, while the ScreenConnect server is not affected. Patching the server alone therefore leaves the exposure in place.

The activity Huntress reported

Huntress reported in late August that across multiple organisations it found unauthorised ScreenConnect client installations and clients that had been tampered with. The activity repeatedly launched wscript.exe to run four malicious VBScripts, and it could push itself to endpoints that newly connected to the same instance, which gives the technique a worm-like reach inside a managed fleet. Remote monitoring and management platforms attract this style of abuse because administrators grant them broad execution rights on purpose.

Response

• Inventory the ScreenConnect client version on every managed endpoint rather than on the servers only, and upgrade anything below 26.6.5.
• As a temporary control, open Administration, then Security, then Roles, and clear the TransferFiles permission for each role. ConnectWise states that this step does not replace the upgrade.
• Hunt for wscript.exe spawned by the ScreenConnect client process, for client installations that no change record explains, and for client binaries whose hash does not match a vendor build.
• Review session records for transfers that completed without a matching host approval event.

RMM tooling sits inside the trust boundary of most estates, and MITRE ATT&CK tracks this behaviour under T1219. When the tool is the target, the access that makes administration efficient is the same access that makes an intrusion quiet, which is why client-side versions deserve the same inventory discipline as the servers.