CVE-2026-84869 is a CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) vulnerability in the ConnectWise ScreenConnect client, tracked under CWE-862 (Missing Authorization) and CWE-269 (Improper Privilege Management). It allows files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances; only ScreenConnect clients are affected, not servers. ConnectWise shipped the fix in ScreenConnect 26.6.5 on 2026-09-08, and had earlier (2026-09-07) issued interim guidance to disable the TransferFiles permission on all session-group roles as a temporary mitigation.

Huntress reported the flaw has been exploited in the wild since 2026-08-20. Three unrelated incidents combined distinct social-engineering lures -- a Quick Assist tech-support scam, a phishing-delivered 'ScreenConnect.ClientSetup.msi' installer, and a fake Geek Squad refund-form lure delivering 'ScreenConnect.Client.exe' -- to get a rogue ScreenConnect client installed. Once installed, the client repeatedly spawned wscript.exe to run a four-stage VBScript chain (1.vbs-4.vbs): 1.vbs profiles the host (RAM >5GB check, existing-ScreenConnect check, enumeration of Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos, and Symantec Endpoint Protection) and writes a three-bit state value to %TEMP%\value.txt; 2.vbs fetches a base64/XOR-obfuscated payload map from Dropbox and writes %TEMP%\map.txt; 3.vbs downloads the AES-encrypted payload selected by the state value (branches: 000/001 = user-level ScreenConnect backdoor, 010 = UAC-bypass/persistence tooling, 011 = tunneling + cryptominer); 4.vbs decrypts the payload via an inline PowerShell runner (runner.ps1, execution-policy bypass) into %APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip and launches PyTorchFix.ps1, then kills wscript.exe/cscript.exe and cleans the staging directory. Windows Defender flags the chain as Trojan:Script/Wacatac.H!ml.

The '010' access package builds a UAC-bypass helper (Password.exe) via inline C# abusing the hijacked ms-settings: protocol handler through ComputerDefaults.exe, sets AmsiUtils.amsiInitFailed=true to blind AMSI, adds C:\Users to Defender exclusions, tunes power settings to prevent sleep, installs a concealed second ScreenConnect client (ID 7a4d7d66502d4260), strips its Registry uninstall entry, and applies a restrictive service security descriptor. The '011' package disables Defender reporting/notifications and Hypervisor-Protected Code Integrity, drops wstunnel disguised as Themes.exe for C2 tunneling over homehub.opik[.]net:443, runs an XMRig cryptominer renamed SearchIndex.exe, and stages a vulnerable WinRing0 driver (svcdrv64.sys) for kernel-level privilege abuse. Persistence is established via an HKCU Run key (WindowsServiceHost) pointing to %AppData%\WindowsServiceHost.vbs / WindowsServiceHost.bat.

The campaign is worm-like: modified '010'-state ScreenConnect clients monitor the EndPointStatusMessage.Connections collection for newly established Host sessions and automatically repackage 1.vbs-4.vbs into ScreenConnect file-transfer/execute messages queued against each new connection, copying the scripts to C:\Users\Public\Libraries\Default\Lib\Lib1 -- this abuse of the legitimate file-transfer/execute feature against every newly connected session is the direct mechanism of CVE-2026-84869. Connection IDs are tracked to avoid re-targeting a session but are cleared on disconnect, allowing re-infection on reconnect. A secondary RMM tool, UltraViewer, was also observed connecting to attacker infrastructure. The Dropbox-hosted staging URLs went offline around 2026-09-02. No threat-actor attribution has been published; the cryptomining, BYOVD, and backdoor tooling point to financially motivated cybercrime rather than a named APT group.

CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on 2026-09-11, giving Federal Civilian Executive Branch agencies until 2026-09-14 (a 3-day window) under Binding Operational Directive 26-04. As of the 2026-09-16 reporting, Shadowserver tracked over 1,000 unpatched, internet-exposed ScreenConnect instances (758 in North America, 180 in Europe). ScreenConnect is used by more than 100,000 IT service providers, and CISA notes this class of RMM abuse is 'a frequent attack vector for malicious cyber actors'; since 2024 CISA has added four ScreenConnect CVEs to KEV, two of which were tied to ransomware campaigns (including CVE-2024-1709, exploited by the North Korea-linked Kimsuky group and multiple ransomware gangs).