ScreenConnect Flaw Let Malware Hop Between Remote Sessions on Its Own

An attacker with low-privilege access to an active ConnectWise ScreenConnect session can transfer and run files on the other end without the connected technician confirming anything, under a flaw CISA added to its exploited-vulnerabilities catalog Sept. 11. ConnectWise rates the bug, CVE-2026-84869, a 9.9 out of 10 on the CVSS severity scale, and says ScreenConnect servers themselves are not affected, only the client.

What the flaw actually allows

ConnectWise's Sept. 8 security bulletin describes a condition that lets files move and execute through an active remote session without the authorization or host confirmation ScreenConnect normally requires. ConnectWise patched it in version 26.6.5. Cloud customers were upgraded automatically; anyone running ScreenConnect on their own servers has to apply the update themselves.

The flaw is tracked under two weakness categories, missing authorization and improper privilege management, and its severity rating notes that the attacker needs only low privileges to start and that the damage reaches beyond the ScreenConnect client itself once triggered. That combination, rather than any single step, is what pushes the score to 9.9.

How Huntress traced it to a self-spreading campaign

The security firm Huntress documented three separate incidents at unrelated organizations, on Aug. 20 and again on Aug. 24, in which a modified ScreenConnect client repeatedly launched wscript.exe to run a chain of four VBScript files. John Hammond, a principal security researcher at Huntress, wrote that the infected client did not stay put: "Connecting to an infected ScreenConnect client can cause the server-side Host system to receive and execute the same four-stage VBScript chain," spreading the infection to whichever machine the technician connected to next.

Huntress said the initial infections began with tech-support scams run through Microsoft's Quick Assist tool, phishing emails carrying malicious MSI installers, and fake online refund forms. Once inside, the operators layered on the remote-access tool UltraViewer, cryptocurrency miners, privilege-escalation utilities and a vulnerable version of the WinRing0 driver.

Indicator	Role
45.13.237.190	Command server
131.123.40.98:8041	Command server
15.204.185.204	Command server
tele-sync.opik.net	Command domain
homehub.opik.net	Command domain

A three-day window for federal agencies

CISA's catalog entry, added Sept. 11, set a remediation deadline of Sept. 14 for civilian federal agencies, a far tighter window than the two weeks the agency has given for other actively exploited bugs added to the Known Exploited Vulnerabilities catalog, including a batch of MikroTik RouterOS flaws. The agency's severity classification lists the flaw's technical impact as total and confirms exploitation is already active, which is consistent with the short fuse.

Operators who cannot upgrade to 26.6.5 immediately can remove the TransferFiles permission from every user role under Administration, Security and Roles in ScreenConnect's admin console, ConnectWise said, closing the specific path the flaw depends on without a full upgrade. The mitigation is a stopgap; ConnectWise's guidance is still to patch. Remote-access tools like ScreenConnect have long been a target for ransomware crews, including Conti, whose developer a U.S. court sentenced to four years in prison, and Huntress said it expects further variants of the VBScript chain as the operators adjust to the patch.