CTI · corroborated · 2026-09-12

ScreenConnect critical CVE-2026-84869 allows file transfer and execution via active sessions

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1105 Ingress Tool Transfer Command and Control
• T1059 Command and Scripting Interpreter Execution
• T1505 Server Software Component Persistence

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• cybersecurefox.com domain · active · corroborated

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: ScreenConnect CVE-2026-84869 Exploitation and Rogue Installation
id: c3d4e5f6-a7b8-9012-cdef-123456789012
status: experimental
description: Detects exploitation of CVE-2026-84869 in ScreenConnect including rogue ScreenConnect server deployment and unauthorized file transfer
references:
  - https://www.huntress.com/
  - https://securityonline.info/
author: Tia N. List
date: 2026-09-12
tags:
  - attack.initial-access
  - attack.t1190
  - attack.persistence
  - attack.t1505
logsource:
  product: windows
  category: process_creation
detection:
  selection_screenconnect_install:
    Image|endswith:
      - '\ScreenConnect.Service.exe'
      - '\ScreenConnect.Client.exe'
      - '\ScreenConnect.WindowsClient.exe'
    CommandLine|contains:
      - '/install'
      - '/uninstall'
      - '-access'
  selection_screenconnect_file_transfer:
    Image|contains:
      - 'ScreenConnect'
    CommandLine|contains:
      - 'FileTransfer'
      - 'Upload'
      - 'Download'
      - 'System.File'
  selection_screenconnect_shell:
    ParentImage|contains:
      - 'ScreenConnect'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection_screenconnect_install or selection_screenconnect_file_transfer or selection_screenconnect_shell
falsepositives:
  - Legitimate ScreenConnect administrative operations
level: critical

References

• https://www.huntress.com/
• https://securityonline.info/
• https://www.bleepingcomputer.com/