ScreenConnect client flaw under active attack lets files run without technician…

What happened

ConnectWise ScreenConnect is remote support and management software widely used by internal IT teams and managed service providers (MSPs). On September 8, 2026, the vendor released version 26.6.5 to fix CVE-2026-84869. The flaw sits in the ScreenConnect client: during an active remote session, files could in certain circumstances be transferred and executed without authorization and without confirmation from the technician, whom ScreenConnect calls the “Host”. According to ConnectWise, ScreenConnect servers are not impacted.

In late August 2026, Huntress observed attacks in which modified ScreenConnect clients automatically pushed and ran malicious scripts on newly connected machines. The Hacker News reports that these attacks exploited CVE-2026-84869 and ended with the XMRig cryptocurrency miner being installed. The US agency CISA added the flaw to its catalog of actively exploited vulnerabilities on September 11, 2026, and the European EUVD database lists it as exploited since the same day.

The issue resurfaced in November 2026. ConnectWise is investigating unauthorized access to certain partner ScreenConnect environments. Blackpoint Cyber confirmed that a recovered attack toolkit called SCKit exploits CVE-2026-84869 and that the existing patch blocks it. ConnectWise says it has found no evidence that initial access involved a ScreenConnect vulnerability and is instead looking at abuse of third-party extensions.

Why it is dangerous

This is a missing authorization flaw (CWE-862) combined with improper privilege management (CWE-269). Picture a technician visiting a customer to fix a PC, while the customer quietly slips a package into their bag that opens by itself back at the office. In ScreenConnect terms, a file could pass through an active session and run without anyone approving it.

According to the CVSS vector, the attack works over the network, is not complex and needs no user interaction, but the attacker does need low-level privileges. Blackpoint Cyber describes how SCKit uses it: from a compromised managed machine, it tries to send malicious code back to the technician who connects to it. If that works, it searches the technician’s browser for a logged-in ScreenConnect session and uses their permissions to push commands to other machines, which Blackpoint Cyber says run as NT AUTHORITY\SYSTEM. That way an intrusion can jump to other customers. Researchers have not yet observed this spread to a technician workstation succeed.

ConnectWise, the vendor, scores the flaw 9.9 out of 10 under CVSS 3.1, which is in the critical range. In its own bulletin it rates the issue “Important” with Priority 1 (High) and recommends patching within days. The CISA KEV catalog lists vulnerabilities that the US agency CISA knows are being exploited in real attacks. US federal agencies had to fix this one by September 14, 2026.

EPSS is a statistical estimate of how likely a flaw is to be exploited in the next 30 days. As of November 12, 2026, it stands at about 0.9% (61st percentile). Since CISA has already confirmed exploitation, this low estimate is no reason to wait.

Who is affected

Affected are ConnectWise ScreenConnect clients prior to version 26.6.5, in both cloud and on-premises deployments. Technicians and MSPs who use ScreenConnect to connect to customer machines are most at risk, because the attack targets their workstations.

According to ConnectWise, ScreenConnect servers themselves are not impacted. However, updating a cloud console does not automatically update the clients on technician workstations. If you do not run ScreenConnect yourself but your IT provider does, ask them whether their clients are already updated.

Users of the RMM+ family of extensions should pay extra attention: Labtech Plus, RMM Plus, RMM+, RMM Plus Password Link and RMM+ Password Link. Huntress found that RMM+ versions 1.0.31 and 1.0.32 would accept a blank access key when the administrator had not configured one.

How to check if you are affected

You can find the server version in the ScreenConnect admin area under Administration > Overview. The same page shows the “Latest Eligible Version”, the newest version your license allows. ConnectWise has already updated cloud instances to 26.6.5.

What really matters is the client version on each technician workstation. The console version alone is not enough. This PowerShell command only reads the registry:

Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*, HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName -like "*ScreenConnect*" } | Select-Object DisplayName, DisplayVersion

If the client does not show up, look for the ScreenConnect.WindowsClient.exe file and check its version:

Get-ChildItem "$env:LOCALAPPDATA\Apps", "${env:ProgramFiles(x86)}" -Recurse -Filter ScreenConnect.WindowsClient.exe -ErrorAction SilentlyContinue | Select-Object FullName, @{n="Version";e={$_.VersionInfo.FileVersion}}

Under Administration > Security > Roles, check which roles have TransferFiles enabled (called TransferFilesInSession in older versions). In the extensions list, check whether any RMM+ extension is installed.

How to fix it

The fixed version is ScreenConnect 26.6.5. ConnectWise recommends deploying it as an emergency change, within days at most. Work in this order:

On-premises server: on the Administration > Overview page, confirm you are on version 25.4 or later and that 26.6.5 is eligible under your license. If your license is out of maintenance, you must renew it first. If your renewal is due in 2026, you can upgrade to 26.6 without renewing.
Upgrade the server to 26.6.5 following the ConnectWise guide. Partners with a ConnectWise Automate integration will find the update on the Automate Product Updates page. Cloud instances were updated by the vendor.
Reinstall the host client on every technician workstation and confirm it runs 26.6.5 or later. Update the access agents on managed machines as well.
Keep the RMM+ family extensions disabled and do not reinstall them. On-premises partners should disable them right away. ConnectWise has already disabled them in roughly 400 cloud environments as a precaution.
From a trusted device, revoke all active ScreenConnect web sessions and identity provider sessions, reset credentials and enforce multi-factor authentication (MFA). A password reset alone does not end existing sessions. Also review your users and their permissions.

Temporary measure if you cannot update right away: in Administration > Security > Roles, edit each role, remove the TransferFiles permission (formerly TransferFilesInSession) from every session group and save. ConnectWise stresses that this is not a substitute for updating.

What if you may already be compromised

Huntress advises treating RunFiles or RanFiles entries in the ScreenConnect audit log as suspicious when they show scripts 1.vbs to 4.vbs executed from the Guest process. Further indicators from Huntress and Blackpoint Cyber:

ScreenConnect.WindowsClient.exe spawning wscript.exe
a WindowsServiceHost entry in the Run key pointing to WindowsServiceHost.vbs in the AppData folder
files sc.msi, sckit-run.bat, sckit-decoder.ps1, SilentForceInstall-WithUninstall.ps1, unknown ScreenConnect or UltraViewer installations
connections to 45.13.237[.]190, 131.123.40[.]98, 15.204.185[.]204 or ns.mo7sen[.]dev

The command below lists the Run key entries for the signed-in user. Run it under each user account on the machine and look for WindowsServiceHost:

reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

ConnectWise recommends watching for unusual sign-ins, unexpected MFA prompts, new administrators, permission changes, unapproved remote access software, and Run Command, Toolbox and extension installation records. Finding nothing does not rule out a compromise.

If you suspect an attack, do not investigate through ScreenConnect. Use EDR or another independent tool and include technician workstations. Preserve evidence, isolate affected servers and bring them back only after they have been investigated, rebuilt and patched. If you have no in-house security team, bring in an incident response specialist.

Sources

Articles are put together by an AI agent from public sources (vendors, CISA, ENISA, NVD, SK-CERT, NÚKIB), and version numbers and CVEs are checked against them automatically. Always confirm the steps in the vendor advisory before touching production.

ScreenConnect client flaw under active attack lets files run without technician approval