Security1 publisher2 min readPublished
Attackers have been pushing VBScript through live ScreenConnect sessions since August 20
ConnectWise fixed CVE-2026-84869 in ScreenConnect 26.6.5 after Huntress traced a modified client dropping four VBScript files onto machines it held active sessions with. CISA gave federal agencies three days.
The Watch · Security desk
What happened
- ConnectWise has patched CVE-2026-84869, a missing authorization and privilege management flaw in the ScreenConnect client rated 9.9 on CVSS, in version 26.6.5, and told users to apply it as soon as possible.
- Huntress reported that the flaw had been exploited in the wild since August 20.
- Victims were socially engineered into running rogue clients, which then checked for active sessions and pushed the payload to the machines connected on the other end.
- CISA added the CVE to its Known Exploited Vulnerabilities catalog on Friday and gave federal agencies three days to patch under BOD 26-04.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure An endpoint's exposure now depends on what the machine at the other end of its support session is running, and that machine sits outside its own patching and perimeter controls.
- capability The active session is all the spread needs on the receiving host. One tricked user hands the attacker execution on every client that instance held a session with.
- decision Installing 26.6.5 closes the flaw without answering whether anything was delivered during the exploitation window, so each shop has to decide if session records from August 20 onward define an incident scope.
Exploitation needs a person to act. According to Huntress's account of the incidents, the chain opens with social engineering: a victim is tricked into running a rogue ScreenConnect client [5]. That client checks for active sessions and pushes the payload to the targets connected on the other end [6]. The 9.9 rating [2] fits the second step better than the first. Initial access depends on someone running an attacker-supplied binary; after that the client spreads on its own.
For managed service providers the movement runs client to client, through the live session. ConnectWise's advisory describes a condition "that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances" [3]. An authorized support session becomes an execution channel with the Host prompt out of the loop. Four VBScript files were dropped in the observed cases, written to establish persistence and to propagate to further ScreenConnect clients [4]. SecurityWeek describes the attacks as worm-like [14].
Exploitation ran from August 20 [7]; Huntress warned in early September [8]. Roughly two weeks between them [9]. The fix is version 26.6.5, and ConnectWise says the release "includes updates to strengthen client and session handling for file-transfer and file-execution actions" [10].
Anyone who cannot install 26.6.5 straight away has one interim step from the vendor. ConnectWise recommends disabling the TransferFiles permission [12]. That closes the transfer path and takes file transfer away from the technicians who use it. ConnectWise offers it as a temporary measure.
The SecurityWeek report does not name a threat actor or give a victim count [13]. The scoping question is narrow: which endpoints held an active session with a machine running an attacker-supplied client on or after August 20. Session logs answer that one.
What to watch
- Indicators from Huntress or ConnectWise that separate the modified client build from legitimate ScreenConnect installers.
- Ransomware affiliates adopting the VBScript propagation stage. Adoption would move this from opportunistic spread to a staging tool.
- Whether CISA reports agency compliance with the three-day BOD 26-04 deadline or extends it.