ConnectWise patched ScreenConnect flaw CVE-2026-84869 five days after warning files could be transferred and executed via active sessions without authorization.
ConnectWise released ScreenConnect client version 26.6.5 and later to fix CVE-2026-84869, an authentication failure in ConnectWise Remote Access allowing unauthorized file transfer and execution through active remote sessions. The company warned customers on September 3 and advised admins to remove the TransferFiles permission from users with open sessions as an interim mitigation. The advisory does not state that exploitation has been observed.
CISA added three actively exploited vulnerabilities — two JFrog Artifactory and one ConnectWise ScreenConnect — to its KEV Catalog.
CISA added CVE-2026-42016 (JFrog Artifactory incorrect authorization), CVE-2026-42018 (JFrog Artifactory improper authentication), and CVE-2026-84869 (ConnectWise ScreenConnect improper privilege management and missing authorization) to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of such high-risk vulnerabilities on publicly exposed assets and to check for prior compromise. CISA urges all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.
ConnectWise patches ScreenConnect CVE-2026-84869, reported exploited in the wild; administrators should update to 26.6.5.
ConnectWise shipped ScreenConnect 26.6.5 to fix a vulnerability tracked as CVE-2026-84869 affecting versions prior to 26.6.5. Open-source reporting indicates the flaw is being exploited in the wild. The Canadian Centre for Cyber Security issued advisory AV26-903 urging users and administrators to apply the patch.
Huntress warns of worm-like attacks using modified ScreenConnect clients to spread VBScript payloads; ConnectWise issued an advisory.
Campaigns starting in late August use social engineering, including Quick Assist abuse, to install rogue ScreenConnect clients that spawn wscript.exe and deploy four VBScript files for reconnaissance, staging, and PowerShell execution. The attackers persist via User Run Keys, attempt UAC bypass, install UltraViewer, and propagate the VBScript chain to other connected ScreenConnect endpoints. ConnectWise published an advisory about a file transfer behavior issue affecting cloud and on-premises ScreenConnect, with a CVE identifier and fix expected within a week; it recommends disabling file transfer meanwhile.
Huntress says rogue ScreenConnect clients spread a four-stage VBScript chain delivering backdoors, privilege-escalation tools, or an XMRig miner to newly connected hosts.
Huntress identified three unrelated August 2026 incidents using a Quick Assist tech-support scam, a phishing-delivered MSI installer, and a fake Geek Squad refund form to install rogue ScreenConnect clients. Each client repeatedly spawned wscript.exe to run 1.vbs through 4.vbs, which profiled the host, enumerated installed security products, and downloaded stage-specific payloads from Dropbox. Depending on detected state, payloads included a user-level ScreenConnect backdoor, UAC-bypass privilege escalation tooling, or tunneling utilities with an XMRig cryptocurrency miner. Infected clients re-infected newly connected hosts, creating worm-like propagation, and ConnectWise issued an advisory about affected file transfer behavior in ScreenConnect.
ConnectWise warns of an unpatched ScreenConnect flaw affecting file transfer in support sessions and shares interim mitigations for MSPs.
ConnectWise disclosed a new ScreenConnect Remote Access vulnerability affecting file transfer behavior in both cloud and on-premises deployments; no CVE ID or patch is available yet, with a fix planned later this week. The vendor published temporary mitigation steps that remove TransferFiles permissions from session groups across all roles. Shadowserver tracks nearly 6,000 internet-exposed ScreenConnect instances. Previous ScreenConnect flaws, including CVE-2024-1709, were exploited by ransomware gangs and North Korea's Kimsuky, and three ScreenConnect vulnerabilities are on CISA's actively exploited catalog.
Attackers deploy rogue ScreenConnect clients that spread VBScript malware to newly connected machines while ConnectWise patches a file-transfer flaw.
ConnectWise confirmed a file transfer flaw in ScreenConnect affecting both Cloud and On-Premise deployments, with a CVE identifier and official fix promised within the week; administrators can mitigate immediately by disabling TransferFiles (or TransferFilesInSession) in each role. Huntress documented incidents where social engineering installs rogue ScreenConnect clients that spawn Windows Script Host processes running four VBScript files (1.vbs-4.vbs), add a WindowsServiceHost registry Run key, and propagate to newly connected endpoints. Payloads enabled host profiling, persistence, additional ScreenConnect installs, tunneling, security-control changes, and cryptocurrency mining. ConnectWise has not confirmed a technical link between the flaw and this campaign.
Huntress observed rogue ScreenConnect deployments with worm-like VBScript propagation across unrelated organizations, prompting a ConnectWise advisory on file transfer behavior.
Huntress identified multiple incidents in late August 2026 where social engineering led to rogue ScreenConnect remote access clients deployed on victim machines, which then spawned wscript.exe to run four VBScript payloads (1.vbs through 4.vbs) for profiling, telemetry collection, and persistence via a WindowsServiceHost Run key. Modified ScreenConnect clients propagated the VBScript chain to connected endpoints, creating worm-like spread. ConnectWise published an advisory on September 3, 2026, confirming an issue affecting file transfer behavior in both cloud and on-premises ScreenConnect deployments, with a CVE and fix expected within the week; partners were advised to review and disable TransferFiles permissions in the interim.
Actors abuse Faronics Deploy in phishing campaigns to run PowerShell and deploy ScreenConnect while evading detection with trusted tools.
Huntress investigated attacks in which threat actors abuse Faronics Deploy, a legitimate remote management tool, as part of phishing-driven intrusions. The chain uses the trusted deployment tool to launch PowerShell commands and deploy ScreenConnect for remote access. Leveraging signed, legitimate software helps the actors blend in and evade detection.
Missing authorization in ScreenConnect client allows unauthorized file execution
CVE-2026-84869 is a critical authorization flaw (CWE-862 missing authorization, CWE-269 improper privilege management) in the ScreenConnect client, the endpoint-side agent of ConnectWise's widely used remote access and remote support platform, in which files can be transferred to a machine and executed during an active remote session without the expected authorization or without confirmation by the Host (technician). It is triggered in certain circumstances during an active session, with a network attack vector, low attack complexity, low privileges required, and no user interaction per the CVSS 3.1 vector. An actor who obtains or already holds access to a session context could thereby push and run files on the managed endpoint, potentially achieving code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 score 9.9, scope changed). Only endpoints running the ScreenConnect client are affected; ScreenConnect servers are not impacted, and the affected client version ranges are governed by ConnectWise security advisory AV26-903 (not enumerated in the available data). The flaw is not currently known to be exploited: it is not in CISA KEV, no public proof of concept is known, and EPSS assigns a modest 0.4% probability of exploitation within the next 30 days (32nd percentile).
Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts
ConnectWise ScreenConnect (ConnectWise Control), a widely used remote-access and remote-monitoring tool, contains an authentication bypass (CWE-288) in its management interface. An attacker needs only network access to the management interface to trigger the flaw, with no valid credentials or user interaction required. A successful attacker gains administrative control of the ScreenConnect server by creating a new administrator-level account, providing a foothold that has already been used in ransomware campaigns against downstream managed environments. Any organization running ConnectWise ScreenConnect is affected, especially managed service providers and IT teams whose management interface is reachable from the internet; the source data specifies affected products but no version ranges. Exploitation is confirmed and urgent: CISA added the flaw to the KEV on 2024-02-22 with known ransomware use, EPSS assigns a 100% probability of exploitation within 30 days, and ConnectWise warned that no patch was available at the time of disclosure.
Token Scope Validation Flaw Enables Privilege Escalation in JFrog Artifactory
JFrog Artifactory (Self-Hosted) versions before 7.133.11 fail to validate a token's scope, checking only the token's signature and issuer, which constitutes an incorrect authorization flaw (CWE-863). A remote, authenticated user with low privileges can obtain or present a token whose scope is never verified, bypassing authorization checks and escalating to higher privileges. Successful attackers gain administrative control of the Artifactory instance; in observed attacks this flaw has been chained with CVE-2026-42018 and CVE-2026-82329 to bypass authentication, take admin control, and deploy backdoor malware. Only self-hosted Artifactory deployments are within the stated affected scope. Exploitation is confirmed in the wild and the vulnerability was added to CISA's KEV catalog on 2026-09-11, although no public proof-of-concept code is known.
· JFrog Artifactory (Self-Hosted) All versions before 7.133.11 KEVlarge
Improper Authentication in JFrog Artifactory Exposes Internal Anonymous Tokens
JFrog Artifactory contains an improper authentication flaw (CWE-287) in which the server may return its internal anonymous-user token to an unauthenticated caller, even on instances where anonymous access is disabled. An attacker triggers the issue by sending unauthenticated requests to the affected Artifactory interface over the network; the vector requires no privileges or user interaction and is of low complexity. Successful abuse yields the internal anonymous-user token, which can then be used to reach sensitive resources (such as repositories or artifacts) that should be protected when anonymous access is disabled, with high confidentiality impact but no integrity or availability impact. Any organization running an affected JFrog Artifactory deployment - particularly those relying on disabled anonymous access as a control - is affected, though only instances where the vulnerable endpoint is reachable are actually exposed. Exploitation has been reported in the wild as part of an ongoing Artifactory attack campaign alongside CVE-2026-42016 and CVE-2026-82329, although there is no public PoC and the flaw is not yet in the CISA KEV catalog.
ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE
ConnectWise ScreenConnect versions 25.2.3 and earlier rely on ASP.NET Web Forms ViewState, whose integrity depends on machine keys; if an attacker with privileged system-level access obtains those keys, they can craft and send a malicious ViewState that the server deserializes, potentially resulting in remote code execution. The risk stems from platform-level ASP.NET behavior rather than a defect introduced by ScreenConnect, and the ScreenConnect Client is not directly impacted, though the CVSS vector (PR:H) confirms exploitation requires already having high privileges on the host. An attacker who achieves this gains code execution on the server with the confidentiality, integrity, and availability impact reflected in the 7.2 High score. ScreenConnect 2025.4 mitigates the issue by disabling ViewState entirely and removing any dependency on it. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-06-02, indicating confirmed exploitation in the wild, with EPSS estimating a 3.4% chance of exploitation in the next 30 days (88th percentile).
· ConnectWise ScreenConnect 25.2.3 and earlier; mitigated in 2025.4 (ViewState disabled) KEVlarge
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauth
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not independently affected by this CVE.
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.