A condition in the ScreenConnect client may

CVE-2026-84869 is a missing-authorization flaw in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) that allows files to be transferred *and executed* through an active remote session without the host machine's confirmation or authorization. Because ScreenConnect's client agent typically runs as SYSTEM, successful exploitation yields arbitrary code execution at the highest privilege level on every managed endpoint. The flaw is client-side only — ScreenConnect servers are not directly affected, but they are the conduit through which the exploit is delivered to every connected host.

ConnectWise rated this 9.9 CRITICAL (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and, unusually, that vendor score is *justified*. The PR:L requirement — needing an authenticated ScreenConnect session — might sound like meaningful friction, but Huntress documented a live worm-like campaign in August 2026 where threat actors used social-engineering lures (Quick Assist scams, phishing MSIs) to plant rogue ScreenConnect clients, then weaponized CVE-2026-84869 to auto-propagate a multi-stage VBScript loader across every newly connected host. CISA added it to KEV on September 11 with a federal remediation deadline of September 14, 2026 — a 3-day window that signals maximum urgency.

Why this verdict

• Active exploitation with worm-like propagation. Huntress documented a live campaign where modified ScreenConnect clients auto-spread malicious payloads to every newly connected host, turning a single compromised session into fleet-wide compromise across unrelated organizations.
• Role multiplier: RMM agent = fleet-scale blast radius. ScreenConnect clients run as SYSTEM on every managed endpoint. MSPs deploy it across hundreds or thousands of hosts. Compromising the ScreenConnect session is functionally equivalent to compromising a deployment tool or management plane — the blast radius is the entire managed fleet. ≥95% of ScreenConnect client installs occupy this fleet-management role by definition.
• KEV-listed with 3-day federal deadline. CISA added CVE-2026-84869 to KEV on September 11, 2026 with a September 14 remediation deadline. This is the shortest deadline class CISA assigns, reserved for actively exploited vulns with severe impact.
• Minimal friction in practice. While PR:L (authenticated session) sounds like a gate, the observed campaign demonstrates that social engineering trivially establishes rogue sessions. Once a session exists, exploitation is automatic — no user interaction, low complexity, full SYSTEM execution.
• Scope: Changed. The CVSS S:C flag is accurate — the vulnerability in the client-side authorization logic allows the operator (one trust boundary) to execute code on the host machine (different trust boundary) without authorization, crossing the intended security model.

Why not higher?

A 9.9 or 10.0 would require zero prerequisites — truly unauthenticated remote code execution. This vulnerability requires an authenticated ScreenConnect session (PR:L), which is a real prerequisite even though the worm campaign shows it is easily obtained via social engineering. The 0.1-point reduction from the vendor's 9.9 reflects this single friction point.

Why not lower?

Downgrading below CRITICAL is not defensible. The affected component is canonically a fleet-management agent (100% of installs are in the high-value RMM role by definition), the blast radius is fleet-scale SYSTEM-level code execution, active exploitation with worm-like self-propagation is documented, and CISA issued a 3-day KEV deadline. The PR:L requirement is the only friction point, and it is demonstrably overcome in the wild via social engineering. No combination of friction arguments can pull below the CRITICAL floor for an actively exploited RMM agent vulnerability.

1. Revoke TransferFiles permission from all ScreenConnect roles immediately — ConnectWise documented this as a temporary mitigation: Administration → Security → Roles → remove TransferFiles permission. This directly blocks the exploit's file-transfer step. Deploy within hours — this is your noisgate mitigation SLA emergency action (≤ 3 days for CRITICAL, but given KEV status, treat as immediate).
2. Audit and remove unauthorized ScreenConnect installations — Hunt for ScreenConnect client installations that were not deployed by your IT team. Check for ScreenConnect.ClientService.exe running from non-standard paths, unexpected ScreenConnect relay domains, or the malicious session ID 7a4d7d66502d4260. Remove any rogue instances immediately.
3. Block known C2 infrastructure at perimeter — Add the following to your blocklists: 45.13.237[.]190, 131.123.40[.]98:8041, 15.204.185[.]204, tele-sync.opik[.]net, borertors92.anondns[.]net. This disrupts the observed worm campaign's command-and-control channels.
4. Deploy application allowlisting for ScreenConnect child processes — Configure AppLocker or WDAC to restrict what ScreenConnect.ClientService.exe can spawn. Block wscript.exe, cscript.exe, and unsigned executables as child processes. This breaks the observed VBScript attack chain.
5. Upgrade to ScreenConnect 26.6.5 and reinstall all clients — The definitive fix. On-prem servers must upgrade to 26.6.5 (requires v25.4+ baseline), then reinstall host clients and update access agents — clients do not auto-update on-prem. Cloud instances are already patched server-side but clients still need refresh. Target completion within the noisgate remediation SLA of ≤ 90 days for CRITICAL, though KEV status demands you move faster — aim for days, not weeks.

Run on each managed Windows host where ScreenConnect client may be installed. Execute as Administrator in PowerShell. Example: powershell -ExecutionPolicy Bypass -File .\Check-CVE-2026-84869.ps1

#Requires -RunAsAdministrator
# Check-CVE-2026-84869.ps1
# Detects vulnerable ScreenConnect client installations (< 26.6.5)
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$found = $false
$vulnerable = $false
$minSafe = [version]'26.6.5'

# Check installed programs (both 32-bit and 64-bit registry hives)
$regPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

foreach ($path in $regPaths) {
    Get-ItemProperty -Path $path -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -match 'ScreenConnect' } |
        ForEach-Object {
            $found = $true
            $ver = $null
            try { $ver = [version]$_.DisplayVersion } catch {}
            if ($ver -and $ver -lt $minSafe) {
                Write-Host "VULNERABLE - ScreenConnect client $($_.DisplayVersion) found: $($_.DisplayName)" -ForegroundColor Red
                $vulnerable = $true
            } elseif ($ver) {
                Write-Host "PATCHED - ScreenConnect client $($_.DisplayVersion) found: $($_.DisplayName)" -ForegroundColor Green
            }
        }
}

# Also check running service
$svc = Get-Service -Name 'ScreenConnect Client*' -ErrorAction SilentlyContinue
if ($svc) {
    $proc = Get-Process -Name 'ScreenConnect.ClientService' -ErrorAction SilentlyContinue
    if ($proc) {
        $fileVer = $proc.MainModule.FileVersionInfo.FileVersion
        try {
            $fv = [version]$fileVer
            if ($fv -lt $minSafe) {
                Write-Host "VULNERABLE - Running ScreenConnect client service version $fileVer" -ForegroundColor Red
                $vulnerable = $true
                $found = $true
            } else {
                Write-Host "PATCHED - Running ScreenConnect client service version $fileVer" -ForegroundColor Green
                $found = $true
            }
        } catch {}
    }
}

# Check for rogue indicators (IOCs from Huntress campaign)
$rogueKey = Get-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'WindowsServiceHost' -ErrorAction SilentlyContinue
if ($rogueKey) {
    Write-Host "WARNING - Rogue persistence key 'WindowsServiceHost' detected in HKCU Run. Possible worm campaign IOC!" -ForegroundColor Yellow
}

if (-not $found) {
    Write-Host "UNKNOWN - No ScreenConnect client installation detected on this host."
    exit 2
} elseif ($vulnerable) {
    exit 1
} else {
    exit 0
}

Sources

1. ConnectWise Security Bulletin (2026-09-08)
2. Huntress — Rogue ScreenConnect Installations / Worm-Like Activity
3. AiCybr — ScreenConnect 26.6.5 Mitigation Guide
4. SecurityOnline — CVE-2026-84869 Exploitation Analysis
5. TheHackerWire — ScreenConnect Client RCE via Unauthorized File Transfer
6. Field Effect — ScreenConnect Worm-Like Malware Campaign
7. NHS England Digital — Cyber Alert CC-4848
8. SecurityWeek — Modified ScreenConnect Clients in Worm-Like Campaign