CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)

Key facts

Detection coverage

As of 2026-09-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2533 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ScreenConnect Client Spawns Wscript Four-Stage Numbered VBScript Chain (CVE-2026-84869)

Detects a ScreenConnect client process spawning wscript.exe to execute the numbered VBScript infection chain (1.vbs-4.vbs) that profiles the host, downloads a Dropbox-hosted payload map, and stages an AES-encrypted payload -- the observed exploitation mechanism for CVE-2026-84869's missing-authorization file-transfer/execute abuse.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566, T1204.002, T1059.005
• Data sources: sysmon, windows_process_creation, edr_telemetry
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  ParentImage IN ("*\\ScreenConnect.ClientService.exe","*\\ScreenConnect.WindowsClient.exe","*\\ScreenConnect.ClientHost.exe")
  Image="*\\wscript.exe"
| eval vbs_stage=case(
    like(CommandLine,"%1.vbs%"),"1-profile",
    like(CommandLine,"%2.vbs%"),"2-payload-map",
    like(CommandLine,"%3.vbs%"),"3-payload-download",
    like(CommandLine,"%4.vbs%"),"4-decrypt-execute",
    true(),"unknown")
| where vbs_stage!="unknown"
| table _time, ComputerName, User, ParentImage, Image, CommandLine, vbs_stage
| sort -_time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName in~ ("ScreenConnect.ClientService.exe","ScreenConnect.WindowsClient.exe","ScreenConnect.ClientHost.exe")
| where FileName =~ "wscript.exe"
| where ProcessCommandLine matches regex @"[1-4]\.vbs"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: ScreenConnect Client Spawns Wscript Executing Numbered VBScript Chain
id: 7a1e0c3a-4b2f-4e2a-9c6a-1f0d2b3c4d5e
status: experimental
description: Detects ScreenConnect client processes spawning wscript.exe to run the 1.vbs-4.vbs infection chain observed in CVE-2026-84869 exploitation
references:
  - https://www.huntress.com/blog/rogue-screenconnect-installations
  - https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html
author: Threadlinqs Team
date: 2026-09-16
tags:
  - attack.initial-access
  - attack.t1566
  - attack.execution
  - attack.t1204.002
  - attack.t1059.005
  - cve.2026.84869
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
      - '\ScreenConnect.ClientHost.exe'
  selection_child:
    Image|endswith: '\wscript.exe'
  selection_script:
    CommandLine|re: '[1-4]\.vbs'
  condition: selection_parent and selection_child and selection_script
falsepositives:
  - Legitimate IT-automation VBScript tooling deployed via ScreenConnect that happens to use numeric filenames
level: critical

Known false positives:

• Legitimate IT-automation VBScript tooling deployed via ScreenConnect that happens to use numeric filenames

Tuning notes: Scope ParentImage to your organization's actual ScreenConnect client install path; allowlist verified internal automation script SHA256 hashes to cut noise.

• 🔒 1.vbs Host-Profiling Stage: Security Product Enumeration and TEMP State-File Write · unlock with TL Creds
• 🔒 AMSI Tamper, Defender Exclusion Addition, and HVCI Disable (010/011 Access Packages) · unlock with TL Creds
• 🔒 Worm-Like ScreenConnect File-Transfer Propagation to C:\Users\Public\Libraries Staging Path · unlock with TL Creds
• 🔒 Obfuscated Payload-Map Retrieval and Execution-Policy-Bypass PowerShell Runner (2.vbs-4.vbs Chain) · unlock with TL Creds
• 🔒 WindowsServiceHost Run-Key Persistence and Concealed Secondary ScreenConnect Client Install · unlock with TL Creds
• 🔒 XMRig Cryptominer Renamed [indicator] with WinRing0 Vulnerable Driver Staging (BYOVD) · unlock with TL Creds
• 🔒 UAC Bypass via ms-settings Protocol Hijack Through ComputerDefaults.exe ([indicator]) · unlock with TL Creds
• 🔒 wstunnel C2 Tunnel Disguised as [indicator] Beaconing to Known CVE-2026-84869 Infrastructure · unlock with TL Creds

Indicators of compromise

As of 2026-09-16, Threadlinqs Intelligence tracks 27 indicators of compromise for TL-2026-2533.

Sample indicators (3 of 27)

• IP address: 45.13.237[.]190
• Domain: tele-sync[.]opik[.]net
• File hash: 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020

Defanged, TLP:CLEAR. Full set of 27 indicators: unlock with TL Creds.

Technical analysis

CVE-2026-84869 is a CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) vulnerability in the ConnectWise ScreenConnect client, tracked under CWE-862 (Missing Authorization) and CWE-269 (Improper Privilege Management). It allows files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances; only ScreenConnect clients are affected, not servers. ConnectWise shipped the fix in ScreenConnect 26.6.5 on 2026-09-08, and had earlier (2026-09-07) issued interim guidance to disable the TransferFiles permission on all session-group roles as a temporary mitigation.

Huntress reported the flaw has been exploited in the wild since 2026-08-20. Three unrelated incidents combined distinct social-engineering lures -- a Quick Assist tech-support scam, a phishing-delivered 'ScreenConnect.ClientSetup.msi' installer, and a fake Geek Squad refund-form lure delivering 'ScreenConnect.Client.exe' -- to get a rogue ScreenConnect client installed. Once installed, the client repeatedly spawned wscript.exe to run a four-stage VBScript chain (1.vbs-4.vbs): 1.vbs profiles the host (RAM >5GB check, existing-ScreenConnect check, enumeration of Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos, and Symantec Endpoint Protection) and writes a three-bit state value to %TEMP%\value.txt; 2.vbs fetches a base64/XOR-obfuscated payload map from Dropbox and writes %TEMP%\map.txt; 3.vbs downloads the AES-encrypted payload selected by the state value (branches: 000/001 = user-level ScreenConnect backdoor, 010 = UAC-bypass/persistence tooling, 011 = tunneling + cryptominer); 4.vbs decrypts the payload via an inline PowerShell runner (runner.ps1, execution-policy bypass) into %APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip and launches PyTorchFix.ps1, then kills wscript.exe/cscript.exe and cleans the staging directory. Windows Defender flags the chain as Trojan:Script/Wacatac.H!ml.

The '010' access package builds a UAC-bypass helper (Password.exe) via inline C# abusing the hijacked ms-settings: protocol handler through ComputerDefaults.exe, sets AmsiUtils.amsiInitFailed=true to blind AMSI, adds C:\Users to Defender exclusions, tunes power settings to prevent sleep, installs a concealed second ScreenConnect client (ID 7a4d7d66502d4260), strips its Registry uninstall entry, and applies a restrictive service security descriptor. The '011' package disables Defender reporting/notifications and Hypervisor-Protected Code Integrity, drops wstunnel disguised as Themes.exe for C2 tunneling over homehub.opik[.]net:443, runs an XMRig cryptominer renamed SearchIndex.exe, and stages a vulnerable WinRing0 driver (svcdrv64.sys) for kernel-level privilege abuse. Persistence is established via an HKCU Run key (WindowsServiceHost) pointing to %AppData%\WindowsServiceHost.vbs / WindowsServiceHost.bat.

The campaign is worm-like: modified '010'-state ScreenConnect clients monitor the EndPointStatusMessage.Connections collection for newly established Host sessions and automatically repackage 1.vbs-4.vbs into ScreenConnect file-transfer/execute messages queued against each new connection, copying the scripts to C:\Users\Public\Libraries\Default\Lib\Lib1 -- this abuse of the legitimate file-transfer/execute feature against every newly connected session is the direct mechanism of CVE-2026-84869. Connection IDs are tracked to avoid re-targeting a session but are cleared on disconnect, allowing re-infection on reconnect. A secondary RMM tool, UltraViewer, was also observed connecting to attacker infrastructure. The Dropbox-hosted staging URLs went offline around 2026-09-02. No threat-actor attribution has been published; the cryptomining, BYOVD, and backdoor tooling point to financially motivated cybercrime rather than a named APT group.

CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on 2026-09-11, giving Federal Civilian Executive Branch agencies until 2026-09-14 (a 3-day window) under Binding Operational Directive 26-04. As of the 2026-09-16 reporting, Shadowserver tracked over 1,000 unpatched, internet-exposed ScreenConnect instances (758 in North America, 180 in Europe). ScreenConnect is used by more than 100,000 IT service providers, and CISA notes this class of RMM abuse is 'a frequent attack vector for malicious cyber actors'; since 2024 CISA has added four ScreenConnect CVEs to KEV, two of which were tied to ransomware campaigns (including CVE-2024-1709, exploited by the North Korea-linked Kimsuky group and multiple ransomware gangs).

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information

Execution

T1059.001 PowerShell; T1059.005 Visual Basic; T1204.002 Malicious File

Discovery

T1082 System Information Discovery; T1518.001 Security Software Discovery

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Command and Control

T1219 Remote Access Tools; T1572 Protocol Tunneling

Impact

T1496 Resource Hijacking

Persistence

T1547.001 Registry Run Keys / Startup Folder

Privilege Escalation

T1548.002 Bypass User Account Control

Initial Access

T1566 Phishing

Lateral Movement

T1570 Lateral Tool Transfer

Remediation

Patches

• ScreenConnect 26.6.5 (fixes CVE-2026-84869 / CWE-862 / CWE-269)

Immediate actions

• Apply ScreenConnect 26.6.5 or later immediately on all client deployments
• If unable to patch immediately, disable the TransferFiles permission for every session-group role under Administration > Security > Roles (ConnectWise interim guidance, 2026-09-07) -- temporary only, not a substitute for patching
• Review ScreenConnect user accounts and roles, remove unrecognized users, reset passwords, and enable MFA

Workarounds

• Temporarily disable the TransferFiles permission on all session-group roles pending patch deployment

Longer-term hardening

• Restrict internet exposure of ScreenConnect instances (VPN/allow-list access) to reduce the 1,000+ exposed-instance attack surface tracked by Shadowserver
• Deploy EDR with behavioral detection tuned to flag wscript.exe/cscript.exe spawned by ScreenConnect client processes, inline PowerShell with execution-policy bypass, and ms-settings:/ComputerDefaults.exe UAC-bypass chains
• Monitor for rogue/duplicate ScreenConnect client installations, unexpected HKCU Run-key entries, and Defender exclusion or AMSI-tamper changes

Affected and fixed versions

• ConnectWise — ScreenConnect (client)
  Vulnerable versions: prior to 26.6.5
  Fixed in: 26.6.5 and later

Timeline

• 2026-08-20 Huntress observes two unrelated incidents (Quick Assist tech-support scam; phishing-delivered locked-ioc-10) installing rogue ScreenConnect clients that launch the four-stage 1.vbs-4.vbs infection chain.
• 2026-08-24 A third, unrelated incident uses a fake Geek Squad refund-form lure to deliver ScreenConnect.Client.exe, triggering the same VBScript chain.
• 2026-09-02 Dropbox URLs hosting the stage-2/stage-3 payload map and encrypted payloads go offline.
• 2026-09-03 Huntress publishes technical analysis of the worm-like rogue ScreenConnect campaign.
• 2026-09-07 ConnectWise issues interim guidance recommending disabling the TransferFiles permission pending a fix.
• 2026-09-08 ConnectWise releases ScreenConnect 26.6.5, fixing CVE-2026-84869 (CWE-862 / CWE-269); CVE published in NVD with CVSS 3.1 score 9.9.
• 2026-09-11 CISA adds CVE-2026-84869 to the Known Exploited Vulnerabilities catalog, confirming active exploitation.
• 2026-09-14 BOD 26-04 remediation deadline for Federal Civilian Executive Branch agencies (3-day window from KEV addition).
• 2026-09-16 BleepingComputer and The Hacker News report on the KEV addition; Shadowserver tracks over 1,000 unpatched internet-exposed ScreenConnect instances (758 North America, 180 Europe).

Sources cited

• CVE-2026-84869 Detail NVD (NIST) · Advisory · 2026-09-08
• CISA Known Exploited Vulnerabilities Catalog - CVE-2026-84869 CISA · Government advisory · 2026-09-11
• Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity Huntress · Research · 2026-09-03
• 2026-09-08 ScreenConnect Bulletin connectwise.com · Vendor report · 2026-09-08
• CISA Warns of Hackers Exploiting Critical ScreenConnect Flaw BleepingComputer · News · 2026-09-16
• CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV The Hacker News · News · 2026-09-16
• Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts The Hacker News · News · 2026-09-07
• ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks SecurityWeek · News · 2026-09-08

More in vulnerability

• Palo Alto Networks PAN-OS (Panorama) Code Injection RCE as Root - CVE-2026-0330
• SignDrop: Unpatched Windows CLFS Zero-Day Enables Local Privilege Escalation to SYSTEM (No CVE)
• Titan Quest: Anniversary Edition heap overflow in .lvl/.pfx file parsing exploited via malicious custom maps (no CVE)
• Microsoft AI-Assisted Research Discloses 59 Linux Kernel Bug Reports (33 CVEs) Incl. 21-Year-Old cls_u32 Flaw CVE-2026-74544; Local Root LPE Exploits Confirmed for 8 CVEs
• Node.js November 2026 Security Releases Patch 16 Vulnerabilities (HTTP/2 crashes, HTTPS heap/TLS key leak CVE-2026-123864, TLS client-certificate auth bypass)

Other reports on CVE-2026-84869

• SCKit Campaign: Rogue ScreenConnect Clients Deployed Across 288 Devices at 48 Organizations via Hijacked ScreenConnect Panels and RMM+ Extension
• Cisco Secure FMC Exploitation (CVE-2026-20079, CVE-2026-20316) by Qilin Affiliate UAT-11988 and Sandworm-Linked UAT-11823, with ScreenConnect (CVE-2026-84869) and PaperCut (CVE-2026-81578/82078) Management-Layer Exploitation
• Threat Intelligence Snapshot Week 37 2026: FortiGate CVE-2025-25249 Exploitation (PivotC2), StyleSmuggler Magento/Adobe Commerce Zero-Day (CVE-2026-75650), BigBear 2.0 AiTM and Related Campaigns

Previous and next in vulnerability

• CVE-2026-90894 ("ParaShells"): Parallels Desktop for Mac Local Privilege Escalation via Appliance Extract Argument Injection Next report