ScreenConnect Flaw CVE-2026-84869 Exploited as a Worm; CISA Sets a 14 September Deadline

ConnectWise has patched a critical flaw in the ScreenConnect remote-access client that lets a participant in a remote session push files onto the connected machine and run them without the authorization or confirmation those actions are supposed to require. Tracked as CVE-2026-84869 and rated CVSS 9.9, the bug is already being abused in the wild. CISA added it to the Known Exploited Vulnerabilities catalog on 11 September 2026 and set a patch deadline of 14 September for federal agencies. Researchers at Huntress had already documented rogue ScreenConnect installations spreading malware from one host to the next like a wormWorm🛡️Malware that spreads on its own from one system to the next without a user launching it each time, typically by abusing a network service, shared credential, or trusted management channel. A worm's self-propagation is what makes containment, not cleanup, the first response priority., which makes this one of the more urgent items on an MSP or IT team's plate this week.

What Happened

ConnectWise first told customers about the problem on 3 September 2026, describing an issue with file-transfer behavior in ScreenConnect Remote Access support and access sessions and promising a CVE and a fix within the week. The fix landed on 8 September as ScreenConnect 26.6.5, and the same day the flaw was published as CVE-2026-84869.

The vendor's own description is deliberately narrow: a condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or host confirmation in certain circumstances. In a normal session, moving a file to the remote endpoint and executing it is a privileged action that a technician performs deliberately. The vulnerabilityVulnerability🛡️A weakness in software, hardware, or processes that can be exploited by attackers to gain unauthorized access or cause harm. removes the check that gates it, so the transfer-and-run can happen without the endpoint operator's consent.

Two things matter about the scope. First, only the ScreenConnect client is affected. ScreenConnect servers are not vulnerable, which is a meaningful difference from the platform's earlier incidents. Second, the flaw touches both ConnectWise-hosted cloud instances and self-managed on-premises deployments, because both use the same client software.

The Vulnerability

CVE-2026-84869 carries the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H and is classified under two weaknesses: CWE-862, Missing AuthorizationMissing Authorization🛡️A vulnerability class (CWE-862) where an application authenticates who a user is but fails to check whether they are permitted to perform an action. The user is legitimately in the system; the flaw is that a permission boundary inside it is not enforced., and CWE-269, Improper Privilege Management. The distinction between those two and a straightforward authentication bypassAuthentication Bypass📖A security vulnerability that allows an attacker to circumvent the login verification process and gain unauthorized access to a system without providing valid credentials. is worth holding onto. Authentication asks who you are. Authorization asks what you are allowed to do once you are in. Here the session itself is legitimate; what fails is the permission boundary inside it. A party that already has a foothold in a session can reach across the file-transfer feature to place and execute code on the connected system, and the confirmation that should stand in the way is not enforced.

That is why the privileges-required rating is Low rather than None, and why the scope is Changed: the action starts inside the constraints of a session role and ends with code running outside them. On a tool whose entire purpose is remote control of other people's machines, an authorization gap in file execution is close to worst case.

Who Is Affected

Every ScreenConnect client before version 26.6.5 is impacted. The population that should be worried is broad. Managed service providers run ScreenConnect across their whole client base, IT departments use it for internal support, and plenty of small shops rely on it for occasional remote fixes. Each of those deployments is a client install, and each unpatched client is in scope.

The exposure is not theoretical. Huntress reported in early September that it had investigated three unrelated intrusions in late August in which attackers used ScreenConnect to spread a malicious script chain across newly connected machines. John Hammond, a senior principal security researcher at Huntress, described the behavior as worm-like: a compromised or attacker-controlled client watches for new host connections and automatically pushes the same payload to each one over ScreenConnect's own file-transfer channel, with the transfer set to run on arrival. Because the tool is trusted and the traffic looks like ordinary session activity, the propagation blends in.

The initial foothold in those cases came from social engineeringSocial Engineering🛡️The psychological manipulation of people into performing actions or divulging confidential information, exploiting human trust rather than technical vulnerabilities. rather than the flaw itself: a Quick Assist tech-support scam, a phishingPhishing🛡️A social engineering attack using fake emails or websites to steal login credentials or personal info. email carrying a malicious installer, and a fake refund form. Once a rogue client was running, the file-transfer weakness turned a single infected endpoint into a launch point for everything that connected to it. Anyone weighing the risk should treat CVE-2026-84869 less as a way in and more as an accelerant that widens a small compromise into a large one.

Technical Analysis

The campaign Huntress documented runs a four-stage script loader. A rogue ScreenConnect client repeatedly launches the Windows Script Host to execute four VBScript files, numbered one through four. The first profiles the machine, noting installed security products and whether ScreenConnect is already present, and encodes the result as a short state value. The later stages pull an encrypted payload from a cloud file-sharing link, decrypt it with a PowerShell runner, and drop tooling matched to the profile: a user-level ScreenConnect backdoor for persistence, privilege-escalation and user-account-control bypass utilities, a tunneling proxy renamed to look like a Windows binary, and a cryptocurrency miner disguised the same way. Persistence is established through a registry Run key.

The worm mechanism is the novel part. The modified client monitors its own list of active connections, and when a new host session appears it transfers the four scripts and marks them to execute. Connection identifiers are tracked during a session and cleared on disconnect, so a machine that reconnects later can be infected again. No new credential, no new exploitExploit🛡️Code or technique that takes advantage of a vulnerability to cause unintended behavior, such as gaining unauthorized access., and no user interaction is needed for each hop; the trusted file-transfer feature does the work.

Defenders have concrete signals to hunt for. In ScreenConnect audit logs, file-run actions initiated by the guest side of a session, or the Windows Script Host and PowerShell spawning inside a session, should be treated as suspicious. The registry Run key persistence and the renamed tunneling and mining binaries are additional artifacts. Huntress advised that confirmed infections be rebuilt from known-good media rather than cleaned in place, because a user-level backdoor and a self-spreading design make partial cleanup unreliable.

Immediate Actions

Patching is the fix. Cloud customers are updated automatically by ConnectWise, but should reinstall host clients and update their access agents afterward so no stale client lingers. On-premises operators need to install ScreenConnect 26.6.5 from ConnectWise, which requires a minimum starting version of 25.4.

If you cannot patch immediately, ConnectWise's stopgap is to remove file-transfer capability from session roles. In the administration console under Security and then Roles, deselect the TransferFiles permission, called TransferFilesInSession in legacy versions, across every role. That change takes effect without an upgrade and closes the abused path until the client is updated. Because active exploitation is confirmed, treat the mitigation as a bridge measure and not a substitute for the patch, and understand the tradeoffs in disabling a feature technicians rely on, covered in how attackers turn a trusted file-transfer feature into a malware delivery channel.

Beyond the patch, assume that an unpatched, internet-reachable ScreenConnect fleet may already have been touched. Review session audit logs for the signals above, hunt for the persistence and renamed-binary artifacts, and plan for containment before cleanup, because self-propagating malware can outrun a host-by-host response. Detecting malicious use of your own remote-access tools and knowing why self-propagating malware forces you to contain before you clean are the two skills this incident rewards.

Long-Term Outlook

Remote-access and remote-management tools sit in a uniquely dangerous position: they are trusted, widely deployed, and built to execute code on other machines. ScreenConnect has been a repeat target, with a mass-exploited authentication-bypass flaw in 2024 and a customer-affecting incident in 2025, and the pattern is not unique to one vendor. The lesson is not to abandon these tools but to treat them as privileged infrastructure: minimize the permissions each role carries, monitor session activity as closely as you monitor endpoints, and rehearse a response that assumes the tool itself can be turned against the network it manages. The teams that come out of this week in good shape will be the ones that patched fast and had those habits already in place.

Sources

• ConnectWise ScreenConnect security bulletin, 8 September 2026: https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
• CVE-2026-84869 record (ConnectWise CNA): https://cveawg.mitre.org/api/cve/CVE-2026-84869
• NVD entry for CVE-2026-84869: https://nvd.nist.gov/vuln/detail/CVE-2026-84869
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Huntress, "Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity": https://www.huntress.com/blog/rogue-screenconnect-installations
• Help Net Security, "Attackers spread malware through ScreenConnect file transfers," 7 September 2026: https://www.helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/
• CSO Online, "ConnectWise patches critical ScreenConnect authentication failure after five days": https://www.csoonline.com/article/4221263/connectwise-patches-critical-screenconnect-authentication-failure-after-five-days-2.html