Key Takeaways<\/p>\n
- \n
- CISA lists CVE-2026-84869 as exploited.<\/strong> Civilian US federal agencies had until September 14 to apply patches and conduct forensic reviews.<\/li>\n
- ConnectWise limits the flaw to the client.<\/strong> Servers remain unaffected. The severity rating is Important with Priority 1 High and a CVSS score of 9.9.<\/li>\n
- Version 26.6.5 fixes the issue.<\/strong> Cloud servers are already updated. Host clients and Access Agents require a fresh installation.<\/li>\n
- Huntress observed three incidents in late August.<\/strong> Modified clients pushed files 1.vbs through 4.vbs to newly connected hosts.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/strong> Attackers Read GitLab Files Without Login \u00b7 Foreign Commands Possible on 8,393 Gitea Servers<\/p>\n
CISA Gives US Agencies Three-Day Deadline<\/h2>\n
The US agency CISA added the vulnerability CVE-2026-84869 to its catalog of known exploited flaws on September 11. The entry concerns ConnectWise ScreenConnect. CISA describes it as a lack of authorization and poor permission management: Files can be transferred and executed during an active remote session without host approval.<\/p>\n
Civilian US federal agencies had until September 14 to patch affected systems or implement alternative protections. The catalog also requires forensic analysis. CISA marks Ransomware exploitation as unknown.<\/p>\n
The Canadian Cyber Centre<\/a> confirms in advisory AV26-903, updated on September 11, the same inclusion in the catalog of known exploited vulnerabilities. German operators face no comparable deadline, but remain exposed to the same attack.<\/p>\n
Files Execute in Session Without Host Approval<\/h2>\n
ConnectWise<\/a> described the flaw on September 8, restricting it to the client. Servers remain unaffected.<\/p>\n
ConnectWise assigns it a CVSS score of 9.9. The vector includes network-based attacks, low complexity, and low privileges. No host approval is required.<\/p>\n
All ScreenConnect versions prior to 26.6.5 are affected. Version 26.6.5 and later resolve the issue. ConnectWise had already warned customers on September 3 about the file transfer behavior and advised removing the TransferFiles permission in open sessions. The patch followed five days later.<\/p>\n
\nDefinition \u00b7 ScreenConnect<\/p>\n
What is ScreenConnect?<\/strong> Remote support software from ConnectWise for support and access sessions. Service providers and internal IT teams use it to control remote machines. The cloud version is hosted by ConnectWise, while the on-premise version is self-hosted by the customer. The client on the host executes file transfers and commands.<\/p>\n<\/div>\n
Huntress Identifies Four Scripts Run Through the ScreenConnect Client<\/h2>\n
Huntress<\/a> observed the same pattern across multiple organizations at the end of August. Rogue clients triggered the Windows Script Host to execute four consecutive VBScript files. The incidents began with social engineering, after which already installed, modified clients automatically pushed the same files to newly connected endpoints. Huntress describes this spread as worm-like.<\/p>\n
Two of the documented cases occurred on August 20, and one on August 24. One attack started via Quick Assist, another through a downloaded installer, and a third through a fake refund form.<\/p>\n
Huntress labels the files 1.vbs through 4.vbs. In ScreenConnect audit logs, RunFiles or RanFiles with these names executed from the Guest process are flagged as suspicious.<\/p>\n
John Hammond, Senior Principal Security Researcher at Huntress, told Help Net Security<\/a> that the observed activity aligns with the vulnerability description. Huntress had previously coordinated its findings with ConnectWise. No specific threat actor group has been identified.<\/p>\n
Cloud Update Leaves Host Clients Vulnerable<\/h2>\n
ConnectWise has already updated its cloud servers, but the advisory still requires reinstalling host clients and updating access agents. On-premises partners first upgrade to version 26.6.5 and then perform the same client steps. Until then, disabling file transfer permissions in affected sessions reduces the attack surface.<\/p>\n
\n - ConnectWise limits the flaw to the client.<\/strong> Servers remain unaffected. The severity rating is Important with Priority 1 High and a CVSS score of 9.9.<\/li>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/09\/cisa-listet-gitlab-dateien-ohne-login-cover-hero-3-250x143.jpg\")
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/09\/cisa-listet-mikrotik-nach-ssh-uebernahmen-cover-hero-1-250x141.jpg\")
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/08\/gitea-8393-ungepatchte-ips-trotz-juli-fix-cover-hero-250x143.jpg\")