ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

Summary

ConnectWise has released patches for a critical vulnerability (CVE-2026-84869) in its ScreenConnect software, which has been exploited in worm-like attacks since August. The flaw allows unauthorized file transfer and execution within active remote sessions. The US CISA has added this CVE to its Known Exploited Vulnerabilities catalog, mandating federal agencies to patch it.

Full text

ConnectWise has released urgent patches for a critical-severity vulnerability in the ScreenConnect remote access and support software that has been exploited in worm-like attacks. Tracked as CVE-2026-84869 (CVSS score of 9.9/10), the security defect is described as a missing authorization and improper privilege management issue. The bug creates “a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances,” ConnectWise explains in its advisory. In early September, cybersecurity firm Huntress warned that the vulnerability has been exploited in the wild since August 20. As part of the observed incidents, a modified ScreenConnect instance was used to deploy four VBScript files designed to establish persistence and propagate to other ScreenConnect clients. The hackers used social engineering to trick victims into executing rogue ScreenConnect clients, which then checked for active sessions to push the VBScript payload to connected targets.Advertisement. Scroll to continue reading. ConnectWise resolved the flaw in ScreenConnect version 26.6.5 and urged users to apply the fixes as soon as possible. As a temporary mitigation, it recommends disabling the TransferFiles permission in ScreenConnect. “The ScreenConnect 26.6.5 patch includes updates to strengthen client and session handling for file-transfer and file-execution actions,” ConnectWise notes. On Friday, the US cybersecurity agency CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities (KEV) catalog, urging federal agencies to patch it within three days, as mandated by BOD 26-04. Related: BlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-Days Related: GitLab Vulnerability Exploited One Day After Disclosure Related: Check Point Patches Critical VPN Vulnerabilities Related: PaperCut Flaws Exploited in AI-Powered Attacks Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Check Point Patches Critical VPN VulnerabilitiesSurfshark Systems Targeted by HackersPaperCut Flaws Exploited in AI-Powered AttacksCritical NetScaler Vulnerability Exploited in Attacks4.1 Million Impacted by AdaptHealth Data BreachNew ‘ShieldCrash’ Zero-Day Exploit Targets Microsoft DefenderFortinet Code Execution Flaw Exploited in PivotC2 RAT AttacksHelmGuard Raises $7.3 Million for Agentic GRC and Security Latest News Three JFrog Artifactory Flaws Exploited for Backdoor DeploymentAnthropic CEO Dario Amodei Says AI Industry Needs to Give Safety Measures Time to Catch UpBlueMoon Exploit Kit Chains Recent Chrome, Windows Zero-DaysUsers in Houthi-Held Yemen Tried to Develop Advanced Weapons With AI, Anthropic SaysPhishing Research Challenges Conventional Security Awareness TestingGitLab Vulnerability Exploited One Day After DisclosureIn Other News: InjectEave Attack, SIM Swapper Sentenced, Glasswing Findings ReviewTrezor Says 347,000 Users Received Phishing Emails After Brevo Hack Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Virtual Event: Attack Surface Management Summit 2026 September 16, 2026 Join as speakers examine the various components of ASM strategy, the push to mandate continuous asset visibility and inventory tools, and the use of red-teaming, bug bounties and pen-tests in modern security programs. Register Webinar: Minimum Viable Business: Can You Prove Your Organization Would Recover? September 2, 2026 In this live webinar, learn how to define your minimum viable business, identify the systems it depends on, measure actual recovery time against business requirements, and present the gaps to the board as measurable risk. Register People on the MoveZero Networks has named Yossi Dagan as Chief Financial Officer.Manifold has appointed Joe Sullivan to its Board of Directors.Patrick McKinney has joined Turing as Chief Information Security Officer.More People On The MoveExpert Insights This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) The Future of AI-Driven Security Depends on Complete Data For twenty-five years, "data" in security meant logs and events. But logs are a lossy representation of reality. (Danelle Au) The MFA Identity Trap: When Authentication Creates a False Sense of Security Organizations must distinguish identity verification, authentication and threat detection, or risk successfully authenticating the attackers they are trying to stop. (Torsten George) Silent Patches Don’t Stop Attackers – They Blind Defenders Silent patches can become exploit intelligence for attackers while leaving defenders without the context needed to prioritize risk. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• cve — CVE-2026-84869

Entities