ConnectWise Patches Critical ScreenConnect File-Transfer Vulnerability After Worm-Like Campaign
Summary
ConnectWise patched ScreenConnect CVE-2026-84869 in version 26.6.5. Researchers described malware spreading through rogue clients, but ConnectWise has not linked the campaign to the vulnerability.
Key points
- CVE-2026-84869 affects ScreenConnect versions before 26.6.5 and may permit unauthorized file transfer and execution through an active remote session in certain circumstances.
- ConnectWise assigned the vulnerability a CVSS score of 9.9 and said it affects ScreenConnect clients, not servers.
- Cloud-hosted instances were updated automatically; on-premises deployments require a manual upgrade to version 26.6.5.
- As a temporary mitigation, organizations unable to upgrade can remove the TransferFiles permission from user roles.
- Researchers reported that attackers used social engineering to install rogue ScreenConnect clients, which ran a multi-stage VBScript chain and propagated payloads to newly connected endpoints.
- ConnectWise has not linked the observed campaign to the disclosed vulnerability; organizations are advised to upgrade and review unexpected file-transfer and execution activity.
Article Details
- Vulnerability Types
- Unauthorized file transfer and execution through an active remote session
- Severity
- CVSS 9.9
- Affected Versions
- ScreenConnect versions prior to 26.6.5
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Temporarily remove the TransferFiles permission from user roles.
- Temporarily disable file transfer permissions, including TransferFiles and TransferFilesInSession where operationally feasible.
MITRE ATT&CK
T1012 · Query RegistryThe scripts performed host reconnaissance and enumerated installed security products.T1021 · Remote ServicesModified ScreenConnect clients transferred and executed payloads on newly connected endpoints through remote management sessions.T1059.001 · PowerShellThe scripts executed PowerShell commands.T1059.005 · Visual BasicThe malware used a four-stage VBScript chain, 1.vbs through 4.vbs, executed by wscript.exe.T1204 · User ExecutionVictims were induced through Quick Assist tech-support scams and fraudulent support or refund lures to install rogue ScreenConnect clients.T1219 · Remote Access ToolsResearchers observed installation of UltraViewer and concealed ScreenConnect clients to maintain remote access.T1547.001 · Registry Run Keys / Startup FolderPersistence was established through a WindowsServiceHost registry Run key.T1548.002 · Bypass User Account ControlThe activity included attempts to bypass User Account Control.T1566 · PhishingThreat actors used phishing-delivered installers and fraudulent support or refund lures to get rogue ScreenConnect clients installed.
CVE
Vendors
Products
ScreenConnectFollowing the publication of this blog, ConnectWise released ScreenConnect version 26.6.5 to address CVE‑2026‑84869.UltraViewerResearchers also observed installation of remote access tools such as UltraViewer, communications with attacker-controlled infrastructure, attempts to bypass User Account Control (UAC), and deployment of concealed