CVE-2026-84869 in ScreenConnect: client bypass and worm-like spread

ConnectWise patched CVE-2026-84869 in ScreenConnect 26.6.5 (rated 9.9): a missing authorization check lets file transfers in an active session bypass host confirmation and execute on the endpoint. CISA added the flaw to its Known Exploited Vulnerabilities catalog with a 14 September deadline, while Huntress reported rogue client installs and wscript.exe launching malicious VBScripts.

• CWE-269/CWE-862 flaw affects ScreenConnect clients below 26.6.5, rated 9.9
• Patching the server alone leaves exposure; clients must be upgraded
• CISA added the CVE to KEV with a 14 September 2026 deadline
• Huntress found tampered clients and wscript.exe running four VBScripts