CVE-2026-84869

What is ConnectWise ScreenConnect?

ConnectWise ScreenConnect (formerly ConnectWise Control) is a remote support and remote access product used heavily by managed service providers (MSPs) and internal help desks. A ScreenConnect server brokers sessions between technicians and thousands of customer endpoints, with the ability to transfer files and run commands on the remote machine. That reach is exactly what makes it attractive to attackers: a compromised ScreenConnect deployment is a ready-made distribution channel into every connected network. The 2024 "SlashAndGrab" authentication bypass (CVE-2024-1709) showed how quickly ransomware crews adopt ScreenConnect flaws.

Overview

CVE-2026-84869 is a CVSS 9.9 combination of improper privilege management (CWE-269) and missing authorization (CWE-862) in ScreenConnect. Under certain conditions, a party in an active remote session can transfer files to the remote host and execute them without the authorization or host-confirmation prompts ScreenConnect is supposed to enforce. ConnectWise disclosed and fixed it on 2026-09-08. Huntress had already observed the flaw being abused since 2026-08-20 in a self-propagating campaign, and CISA added it to KEV on 2026-09-11.

Affected Versions

After upgrading, ConnectWise instructs partners to reinstall host clients and update access agents so that the new session-permission enforcement applies end to end.

Technical Details

ScreenConnect sessions have a permission model that distinguishes what a host (technician) may do and what requires the guest (remote user) to confirm. File transfer and execution through a session are supposed to be gated by the role's TransferFiles permission and, in unattended-access configurations, by host confirmation. CVE-2026-84869 is a gap in that model: in certain session states the server did not verify that the party initiating a file transfer held the required permission, and the client did not require confirmation before writing and executing the transferred file.

Attack characteristics:

• Authentication: the attacker needs a foothold in an active session (CVSS PR:L), which in practice has been achieved by tricking users into running a modified ScreenConnect client
• Complexity: low
• Vector: network, over the existing ScreenConnect relay
• Impact: arbitrary file write and execution on connected endpoints with scope change (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)

Discovery

ConnectWise's bulletin does not credit a reporter. Huntress identified the in-the-wild exploitation and reported the campaign publicly after the patch shipped.

Exploitation Context

Huntress traced exploitation to at least 2026-08-20, roughly two and a half weeks before the vendor bulletin. The campaign was worm-like: victims were socially engineered into running a modified ScreenConnect client, which then enumerated active sessions and pushed four VBScript files to every connected target to establish persistence and repeat the process from the newly compromised machines. That propagation pattern is what earned the CVSS 9.9 rating despite the low-privilege prerequisite. The operators have not been publicly attributed as of 2026-09-16, and victim counts have not been released.

Remediation

1. Upgrade on-premises ScreenConnect servers to 26.6.5 or later. Cloud tenants were updated by ConnectWise but still need step 2.
2. Reinstall host clients and update access agents across the fleet after the server upgrade, per the ConnectWise bulletin; the fix is not complete until the endpoints run the new client.
3. Interim workaround if you cannot upgrade immediately: disable the TransferFiles permission for all roles under Administration, Security, Roles. This blocks the abused capability at the cost of legitimate file transfer.
4. Hunt for the campaign. Look for unexpected .vbs files written through ScreenConnect sessions (the client's temp and Documents\ConnectWiseControl directories are common landing spots), for ScreenConnect client installers that are not signed by ConnectWise or that point at an unfamiliar relay, and for wscript.exe launched as a child of the ScreenConnect client process.
5. Review session audit logs on the server for file-transfer events from sessions and accounts that should not have that permission, especially between 2026-08-20 and your patch date.
6. Harden going forward: enforce MFA on all ScreenConnect host accounts, restrict which roles can transfer files or run commands, and alert on new access agents being installed outside of change windows.