# CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)

> A missing-authorization/improper-privilege-management flaw in ConnectWise ScreenConnect clients (CVE-2026-84869, CVSS 9.9) lets an attacker who controls one active remote session push and execute files on newly connected Host systems without confirmation. Huntress documented three August 2026 incidents in which social-engineered rogue ScreenConnect installs ran a four-stage VBScript chain to deploy a self-propagating backdoor, UAC-bypass/persistence tooling, an XMRig cryptominer, and tunneling malware; CISA added the CVE to its KEV catalog on 2026-09-11 with over 1,000 unpatched internet-exposed instances still tracked by Shadowserver.

- **Published:** 2026-09-16T00:00:00Z
- **Last reviewed:** 2026-09-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2533
- **ID:** TL-2026-2533
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-84869

## Description

CVE-2026-84869 is a CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) vulnerability in the ConnectWise ScreenConnect client, tracked under CWE-862 (Missing Authorization) and CWE-269 (Improper Privilege Management). It allows files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances; only ScreenConnect clients are affected, not servers. ConnectWise shipped the fix in ScreenConnect 26.6.5 on 2026-09-08, and had earlier (2026-09-07) issued interim guidance to disable the TransferFiles permission on all session-group roles as a temporary mitigation.

Huntress reported the flaw has been exploited in the wild since 2026-08-20. Three unrelated incidents combined distinct social-engineering lures -- a Quick Assist tech-support scam, a phishing-delivered 'ScreenConnect.ClientSetup.msi' installer, and a fake Geek Squad refund-form lure delivering 'ScreenConnect.Client.exe' -- to get a rogue ScreenConnect client installed. Once installed, the client repeatedly spawned wscript.exe to run a four-stage VBScript chain (1.vbs-4.vbs): 1.vbs profiles the host (RAM >5GB check, existing-ScreenConnect check, enumeration of Cisco AMP, CrowdStrike, Huntress, Malwarebytes, SentinelOne, Sophos, and Symantec Endpoint Protection) and writes a three-bit state value to %TEMP%\value.txt; 2.vbs fetches a base64/XOR-obfuscated payload map from Dropbox and writes %TEMP%\map.txt; 3.vbs downloads the AES-encrypted payload selected by the state value (branches: 000/001 = user-level ScreenConnect backdoor, 010 = UAC-bypass/persistence tooling, 011 = tunneling + cryptominer); 4.vbs decrypts the payload via an inline PowerShell runner (runner.ps1, execution-policy bypass) into %APPDATA%\Microsoft\Windows\Templates\Classic\sys_cache.zip and launches PyTorchFix.ps1, then kills wscript.exe/cscript.exe and cleans the staging directory. Windows Defender flags the chain as Trojan:Script/Wacatac.H!ml.

The '010' access package builds a UAC-bypass helper (Password.exe) via inline C# abusing the hijacked ms-settings: protocol handler through ComputerDefaults.exe, sets AmsiUtils.amsiInitFailed=true to blind AMSI, adds C:\Users to Defender exclusions, tunes power settings to prevent sleep, installs a concealed second ScreenConnect client (ID 7a4d7d66502d4260), strips its Registry uninstall entry, and applies a restrictive service security descriptor. The '011' package disables Defender reporting/notifications and Hypervisor-Protected Code Integrity, drops wstunnel disguised as Themes.exe for C2 tunneling over homehub.opik[.]net:443, runs an XMRig cryptominer renamed SearchIndex.exe, and stages a vulnerable WinRing0 driver (svcdrv64.sys) for kernel-level privilege abuse. Persistence is established via an HKCU Run key (WindowsServiceHost) pointing to %AppData%\WindowsServiceHost.vbs / WindowsServiceHost.bat.

The campaign is worm-like: modified '010'-state ScreenConnect clients monitor the EndPointStatusMessage.Connections collection for newly established Host sessions and automatically repackage 1.vbs-4.vbs into ScreenConnect file-transfer/execute messages queued against each new connection, copying the scripts to C:\Users\Public\Libraries\Default\Lib\Lib1 -- this abuse of the legitimate file-transfer/execute feature against every newly connected session is the direct mechanism of CVE-2026-84869. Connection IDs are tracked to avoid re-targeting a session but are cleared on disconnect, allowing re-infection on reconnect. A secondary RMM tool, UltraViewer, was also observed connecting to attacker infrastructure. The Dropbox-hosted staging URLs went offline around 2026-09-02. No threat-actor attribution has been published; the cryptomining, BYOVD, and backdoor tooling point to financially motivated cybercrime rather than a named APT group.

CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on 2026-09-11, giving Federal Civilian Executive Branch agencies until 2026-09-14 (a 3-day window) under Binding Operational Directive 26-04. As of the 2026-09-16 reporting, Shadowserver tracked over 1,000 unpatched, internet-exposed ScreenConnect instances (758 in North America, 180 in Europe). ScreenConnect is used by more than 100,000 IT service providers, and CISA notes this class of RMM abuse is 'a frequent attack vector for malicious cyber actors'; since 2024 CISA has added four ScreenConnect CVEs to KEV, two of which were tied to ransomware campaigns (including CVE-2024-1709, exploited by the North Korea-linked Kimsuky group and multiple ransomware gangs).

## MITRE ATT&CK

- T1566 Phishing
- T1204.002 Malicious File
- T1059.005 Visual Basic
- T1059.001 PowerShell
- T1547.001 Registry Run Keys / Startup Folder
- T1548.002 Bypass User Account Control
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1570 Lateral Tool Transfer
- T1219 Remote Access Tools
- T1572 Protocol Tunneling
- T1496 Resource Hijacking

## Sources

- [CISA Warns of Hackers Exploiting Critical ScreenConnect Flaw](https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/)
- [CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV](https://thehackernews.com/2026/09/cisa-adds-5-actively-exploited.html)
- [Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain to Newly Connected Hosts](https://thehackernews.com/2026/09/rogue-screenconnect-clients-spread-four.html)
- [Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity](https://www.huntress.com/blog/rogue-screenconnect-installations)
- [2026-09-08 ScreenConnect Bulletin](https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin)
- [CVE-2026-84869 Detail](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-84869)
- [CISA Known Exploited Vulnerabilities Catalog - CVE-2026-84869](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869)
- [ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks](https://www.securityweek.com/connectwise-patches-screenconnect-vulnerability-exploited-in-worm-like-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2533