ConnectWise has issued an urgent fix for a critical ScreenConnect vulnerability that attackers were already using to spread between remote-support sessions. The flaw, CVE-2026-84869, affects ScreenConnect and was fixed in version 26.6.5; it is a missing-authorization and privilege-management bug that can let files be transferred and executed through an active remote session without approval in certain cases. Huntress said exploitation began on August 20, with modified ScreenConnect instances dropping VBScript files for persistence and propagation, and CISA has added the bug to its Known Exploited Vulnerabilities catalog.
Sergiu Gatlan
2026.09.16
97% relevant
This directly updates the same ScreenConnect CVE-2026-84869 event by adding CISA KEV inclusion, confirmation of active exploitation, the three-day federal patch deadline, and exposure estimates from Shadowserver showing more than 1,000 unpatched internet-facing instances.
Arctic Wolf Labs
2026.09.14
96% relevant
This source covers the same CVE-2026-84869 event and adds defender-focused detail on the client-side impact: exploitation through active remote sessions, unauthorized file transfers and execution, affected versions prior to 26.6.5, and temporary mitigation by removing TransferFiles permissions if immediate upgrading is not possible.
Arctic Wolf Labs
2026.09.14
94% relevant
This is the same underlying event: the actively exploited ScreenConnect vulnerability CVE-2026-84869. The article adds practical detail that the bug affects the client and session-handling components rather than the server directly, describes the abuse path through active remote sessions and file-transfer permissions, notes CISA KEV inclusion with a Sept. 14 remediation deadline, and repeats the fixed version guidance of 26.6.5+.
Ionut Arghire
2026.09.14
100% relevant
This article establishes a distinct tracked event by combining the vendor patch, confirmed in-the-wild exploitation, specific CVE assignment, worm-like propagation details, and CISA KEV action for ScreenConnect.