Critical Flaw Turned RMM Sessions Into a Spreading Mechanism
ConnectWise has patched a critical vulnerability in its widely deployed ScreenConnect remote monitoring and management (RMM) tool after it was exploited in worm-like attacks that propagated across connected client sessions.
Vulnerability Details
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-84869 |
| CVSS Score | 9.9 (Critical) |
| Root Cause | Missing authorization and improper privilege management |
| Exploitation | Transfer and execute files through an active remote session without authorization |
| Discovered Exploiting | August 20, 2026 |
| Discovered By | Huntress |
| Patched Version | ScreenConnect 26.6.5 |
| Vendor Bulletin | September 8, 2026 |
How the Attacks Spread
Threat actors deployed modified ScreenConnect instances to propagate malicious payloads to connected targets. Documented campaigns involved four malicious VBScript files designed to establish persistence and self-replicate across systems reachable through active remote sessions. Social engineering was used to trick users into running the rogue ScreenConnect clients in the first place, after which the file-transfer/execute flaw allowed the attack to spread without further authorization checks.
Because ScreenConnect is deployed by MSPs to manage large numbers of downstream client endpoints, a single compromised technician session could give attackers a path to numerous connected environments.
Patch and Mitigation
ConnectWise resolved the issue in ScreenConnect 26.6.5, which "strengthens client and session handling for file-transfer and file-execution actions."
Recommended Actions
- Update to ScreenConnect 26.6.5 or later immediately.
- Temporarily disable the
TransferFilespermission in ScreenConnect if you cannot patch right away. - Audit active and historical sessions for unauthorized file transfers or execution of unrecognized VBScript files.
- Federal agencies are required to patch within three days under the CISA Known Exploited Vulnerabilities (KEV) catalog mandate (BOD 26-04), reflecting the severity and active exploitation status.
- MSPs specifically should treat this as urgent — worm-like propagation through RMM tooling can rapidly cascade across every downstream client tenant.
Why This Matters
RMM platforms like ScreenConnect sit at a uniquely privileged point in the supply chain: a single MSP technician's session often has administrative reach into dozens or hundreds of client networks. Vulnerabilities that enable unauthorized file transfer and execution inside that trust relationship — especially ones capable of worm-like spread — represent some of the highest-leverage targets for ransomware affiliates and other financially motivated threat actors.