CVE-2026-84869: 
ScreenConnect Server vulnerability analysis and mitigation

CVE-2026-84869 is a critical improper privilege management and missing authorization vulnerability in the ConnectWise ScreenConnect client that allows an authenticated low-privilege attacker to transfer and execute files through an active remote session without Host confirmation. Disclosed on September 8, 2026, it affects all ScreenConnect versions prior to 26.6.5.9742; ScreenConnect servers are not impacted. It carries a CVSS v3.1 base score of 9.9 (Critical) (ConnectWise Bulletin, Github Advisory).

The vulnerability is rooted in a client-side file-transfer handling condition in ScreenConnect's Support and Access session logic, classified as CWE-862 (Missing Authorization) and CWE-269 (Improper Privilege Management) (ConnectWise Disclosures). Under certain circumstances, file-transfer actions — including elevated execution actions — can be processed through an active remote session without proper authorization checks or Host confirmation, effectively bypassing the intended access control model. An attacker with low-privilege authenticated access to a ScreenConnect session can exploit this condition over the network with no user interaction required and with a changed scope, meaning impact extends beyond the vulnerable component to the Host client system. Observed real-world attack chains involved social engineering victims into connecting to rogue ScreenConnect installations, followed by VBScript execution on the target host (Huntress Blog).

Successful exploitation enables an attacker to transfer arbitrary files to and execute them on the Host client system, resulting in full remote code execution with high confidentiality, integrity, and availability impact. Because the scope is changed (S:C in the CVSS vector), the compromise extends beyond the ScreenConnect client itself to the underlying host operating system, enabling lateral movement, data exfiltration, ransomware deployment, or persistent backdoor installation. Multiple sources have characterized observed attacks as "worm-like" due to the ability to propagate across systems via active ScreenConnect sessions (SecurityWeek, CyberSecureFox).

CVE-2026-84869 is actively exploited in the wild and was added to CISA's Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, with a remediation due date of September 14, 2026 (CISA KEV). CISA also flagged it as requiring forensic triage per BOD 26-04. The EPSS score is approximately 0.38–0.69% (Feedly data and GitHub Advisory), though active exploitation has been confirmed by multiple threat intelligence sources including Huntress and the Canadian Centre for Cyber Security (Huntress Blog, CCCS Advisory). No public proof-of-concept exploit code has been confirmed, but the attack chain (social engineering → rogue ScreenConnect client → VBScript execution) has been documented. The KEV entry notes the vulnerability's potential use in ransomware campaigns is currently unknown.

1. Reconnaissance: Identify targets running ScreenConnect client versions prior to 26.6.5 using network scanning tools (e.g., Shodan, Censys) or by targeting organizations known to use ConnectWise ScreenConnect for remote support.
2. Social Engineering / Rogue Installation: Trick a victim into connecting to an attacker-controlled rogue ScreenConnect server or session, often via phishing emails or fake IT support requests that deliver a malicious ScreenConnect installer.
3. Establish Active Remote Session: Once the victim connects, an active ScreenConnect remote session is established between the attacker's server and the victim's Host client.
4. Exploit Missing Authorization: Leverage the client-side file-transfer handling flaw to initiate file-transfer actions through the active session without triggering Host confirmation prompts or authorization checks.
5. Transfer Malicious Payload: Upload a malicious file (e.g., a VBScript, executable, or script) to the Host client system via the unauthorized file-transfer channel.
6. Execute Payload: Trigger execution of the transferred file on the Host system, potentially using elevated execution actions exposed by the vulnerability, achieving remote code execution on the victim's machine (Huntress Blog, CyberSecureFox).

• Network: Outbound connections from host systems to unrecognized or attacker-controlled ScreenConnect relay servers; unusual ScreenConnect session traffic to domains not matching the organization's known ScreenConnect instance.
• Process: Unexpected child processes spawned by the ScreenConnect client process (e.g., wscript.exe, cscript.exe, cmd.exe, powershell.exe); ScreenConnect client executing VBScript or other scripting engines without user initiation.
• File System: Newly created or modified files in temporary directories or user-writable paths associated with ScreenConnect session activity; presence of VBScript (.vbs) or other script files dropped by the ScreenConnect client process.
• Logs: ScreenConnect audit logs showing file-transfer events initiated without corresponding Host confirmation entries; Windows event logs recording process creation events parented to the ScreenConnect client binary.
• Registry/Persistence: New scheduled tasks, run keys, or services created by processes spawned from the ScreenConnect client; unauthorized ScreenConnect client installations not matching the organization's known instance URL or account ID (Huntress Blog, CISA KEV).

ConnectWise released ScreenConnect version 26.6.5.9742 on September 8, 2026, which addresses this vulnerability; cloud-hosted instances were updated automatically and require no action beyond reinstalling host clients and updating access agents (ConnectWise Bulletin). On-premises partners must manually upgrade to version 26.6.5 or later; partners on versions older than 25.4 must first upgrade to 25.4 before upgrading to 26.6.5. As a temporary workaround for those unable to patch immediately, ConnectWise recommends navigating to Administration > Security > Roles, editing each role, and deselecting the TransferFiles permission for all session groups — this reduces exposure but is not a substitute for patching. After patching, organizations should review and remove unrecognized users, audit roles and permissions, reset passwords, and enable MFA (ConnectWise Disclosures).

ConnectWise published an initial advisory on September 3, 2026 (before the patch was available) and released the security bulletin and patch on September 8, 2026, with cloud instances updated automatically (ConnectWise Advisories). Huntress published a detailed incident analysis documenting rogue ScreenConnect installations and the worm-like VBScript attack chain, which became a widely cited reference for defenders (Huntress Blog). SecurityWeek and BleepingComputer covered the active exploitation and CISA's KEV addition, with BleepingComputer noting that over 1,000 exposed systems remained unpatched days after the patch release (BleepingComputer). The Canadian Centre for Cyber Security (CCCS) and Ireland's NCSC also issued advisories, reflecting broad international concern (CCCS Advisory). Community sentiment on Mastodon and security forums highlighted the severity of the worm-like propagation potential and criticized the delay between ConnectWise's initial advisory (September 3) and patch availability (September 8).