CVE-2026-84869 — ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

1. Executive summary

CVE-2026-84869 is a critical (CVSS 9.9) improper privilege management and missing authorization vulnerability (CWE-269 / CWE-862) in ConnectWise ScreenConnect, the remote access and support platform widely deployed by IT departments and MSPs. The flaw allows an attacker to push a file transfer and execute it through an active remote session without authorization and without host-side confirmation, effectively converting any live session into a malware delivery channel. It is listed in CISA's Known Exploited Vulnerabilities catalogue (added 2026-09-11) with a federal remediation due date of 2026-09-14, and affects both Cloud and On-Premise deployments. For EMEA financial services, the exposure is acute: ScreenConnect endpoints frequently sit on privileged administrative paths into client and internal estates, so successful exploitation yields direct code execution on managed hosts. EPSS is currently recorded at 0%, which we assess as lagging indicator noise given confirmed KEV listing — treat as actively exploited.

2. Regulatory framing

No NIS2 or UK NIS article is directly engaged beyond generic incident-handling duties; the item is a vulnerability disclosure with exploitation confirmed, not a reported incident at a client.

3. Technical analysis & attack chain

Vulnerability mechanism. ScreenConnect's remote session file-transfer function lacks proper privilege management (CWE-269) and authorization checks (CWE-862). The NVD description states the flaw "may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation." In practice this means the control that should require the remote host user to consent to an incoming file — or should require the initiating party to hold an authorized role — is absent or bypassable. An actor who can reach an active session can push a file to the endpoint and trigger execution without the host-side confirmation prompt firing.

Confirmed attack chain

1. Precondition — active session. The attacker requires an active ScreenConnect remote session (Support or Access type) to a target host. The BSI advisory characterises the prerequisite as a remote, authenticated attacker; the session itself is the delivery vehicle.
2. Unauthorized file transfer. Through the active session, the attacker initiates a file transfer to the remote host. The missing authorization check (CWE-862) means this proceeds without the attacker holding the privilege level that should gate file push operations.
3. No host confirmation. The improper privilege management (CWE-269) means the host-side confirmation dialog that should require the endpoint user to accept the transfer does not fire or is bypassed. The file lands on the host silently.
4. Execution. The transferred file is executed on the remote host. Help Net Security reporting (2026-09-07) confirms attackers are using this file-transfer path to spread malware in the wild — this is the basis for the KEV listing.
5. Impact. Attacker-controlled code running on the ScreenConnect-managed endpoint, with the privileges of the session context. Because ScreenConnect Access sessions typically run with elevated service context, execution may land with high local privilege.

Scope. Both Cloud (ConnectWise-hosted) and On-Premise (self-hosted) deployments are affected, per ConnectWise's 3 September advisory as reported by Help Net Security. The vendor stated a CVE identifier and official fix would be issued "within the week" as of 3 September; the CVE (2026-84869) and NVD entry followed on 10 September.

Caveats and confidence. The specific malware families delivered via this channel are not named in the available sources, and no IOCs have been published. The exploitation claim rests on vendor confirmation (ConnectWise) and CISA KEV listing, corroborated by Help Net Security reporting — the mechanism is multi-source; the in-the-wild campaign detail is thin and single-sourced to vendor statements relayed through press. No threat actor attribution exists in the verified reference data; treat any attribution circulating as unconfirmed. The exact affected version range is not stated in the provided material — obtain it from the vendor advisory before scoping patching.

4. Mitigation & containment

P1 — within 24 hours

• Inventory and exposure check. Identify all ScreenConnect instances (Cloud tenants and on-premises servers) and all endpoints running the ScreenConnect client/agent. Both deployment models are affected.
• Apply the vendor fix. ConnectWise committed to an official fix alongside the CVE. Patch on-premises servers to the fixed version immediately; for Cloud deployments, confirm with ConnectWise that the fix has been applied to your tenant and verify. CISA's KEV due date is 2026-09-14 — three days from issuance.
• If the fix is unavailable (per CISA required action): apply vendor mitigations per their instructions, or discontinue use of the product until patched. For financial services, "discontinue" means suspending new remote sessions and locking down the ScreenConnect server, not merely monitoring.
• Restrict session initiation. Until patched, review and tighten who can initiate file transfers within sessions — disable or restrict the file-transfer permission for session roles in ScreenConnect's permission profiles where the UI allows it.

P2 — within 72 hours

• Hunt for abuse. Review ScreenConnect session logs for the period since at least early September (the flaw was publicly discussed from 3 September; exploitation may predate disclosure) for sessions involving file transfers that the endpoint user did not consent to, or transfers initiated by accounts outside expected admin/technician roles. Pull the transferred filenames and check them against endpoint telemetry.
• Endpoint triage. On hosts with active ScreenConnect sessions in the review window, check for unexpected binaries in user-writable paths and review process creation events for executions not correlated to legitimate support activity.
• Network containment. Where on-premises ScreenConnect servers are internet-facing, restrict access to the server's web port (default 8040/443 depending on configuration) to administrative source ranges pending patch verification. Evaluate each asset's internet exposure as CISA directs.

P3 — within 7 days

• Verify patch deployment across the full estate, including MSP-managed endpoints, and confirm Cloud tenant remediation in writing from ConnectWise or your MSP.
• Review session permission model. Rebuild ScreenConnect permission profiles on least-privilege: file transfer and remote execution restricted to named technician roles, host confirmation enforced where the fixed version restores it.
• Update third-party risk records. Where an MSP operates ScreenConnect on your behalf, record the incident-to-fix timeline and confirm contractual patch SLAs met the KEV deadline.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators (derived from the vulnerability mechanism; no atomic IOCs published):

6. Detection

Insufficient indicators to author detection rules. No malware samples, filenames, command lines, hashes, or network artefacts from the exploiting campaign appear in the source material; a rule built from the vulnerability description alone would match legitimate ScreenConnect activity. Revisit once vendor or CISA forensics guidance publishes campaign artefacts.

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• NVD — CVE-2026-84869 — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-84869 — 2026-09-10
• CISA Known Exploited Vulnerabilities catalogue — CVE-2026-84869 entry (added 2026-09-11, due date 2026-09-14) — via NVD record
• Help Net Security — Attackers spread malware through ScreenConnect file transfers — https://www.helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/ — 2026-09-07
• BSI Germany (CERT-Bund) — WID-SEC-2026-3256 — ConnectWise ScreenConnect: Schwachstelle ermöglicht nicht spezifizierten Angriff — https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3256 — September 2026

8. Adverse Trace position

This is a critical, actively exploited vulnerability in remote-access tooling that sits on privileged paths into financial services estates — the combination of CVSS 9.9, KEV listing with a 2026-09-14 deadline, and confirmed in-the-wild malware delivery makes it a patch-now item regardless of the low EPSS score, which we assess as not yet reflecting observed exploitation. The 9.9 score is unusually high for this class and reflects that the flaw converts an authenticated session into unauthenticated-in-effect code execution without any host-side consent control. Clients should treat every ScreenConnect-managed endpoint as potentially compromised back to at least early September and hunt accordingly, not merely patch forward. Attribution is unconfirmed and no campaign IOCs exist yet — we will update this advisory when ConnectWise or CISA publish forensic artefacts, affected version ranges, or detection guidance. Our next step is to monitor for the vendor's detailed advisory and any follow-on CISA forensics requirements under BOD 26-04, and to reissue with IOCs and detection rules when they surface.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.