Reported by 10 outlets

Timeline

1. original reporting

   🔴 CVE-2026-84869 - Critical (9.9) A condition in the ScreenConnect client may allow files to be transferred and executed through an active r

   www.thehackerwire.com · 35d ago · September 8th, 2026

   🔴 CVE-2026-84869 - Critical (9.9) A condition in the ScreenConnect client may allow files to be transferred and executed through an active r

   via Mastodon https://www.thehackerwire.com/vulnerability/CVE-2026-84869/

2. update from malware.news

   ConnectWise security advisory (AV26-903)

   malware.news · 34d ago · September 9th, 2026

   Serial number: AV26-903 Date: September 9, 2026 As of September 8, 2026, ConnectWise is affected by a vulnerability in the following product: ScreenConnect versions prior to 26.6.5 Open-source reporting indicates that CVE-2026-84869 is being exploited in the wild. The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. ScreenConnect 26.6.5 Security Patch ConnectWise - Security Bulletins Article Link: ConnectWise security advisory (AV26-903) - Canadian Centre for Cyber Security

3. mentioned by www.huntress.com

   ConnectWise ScreenConnect # zeroday CVE-2026-84869 Huntress article: https://www. huntress.com/blog/rogue-screen connect-installations Canad

   www.huntress.com · 34d ago · September 9th, 2026

4. update from cybersecurefox.com

   ScreenConnect CVE-2026-84869 Wormable VBScript Attacks 🔗 https:// cybersecurefox.com/en/screenco nnect-cve-2026-84869-wormable-vbscript # sc

   cybersecurefox.com · 33d ago · September 10th, 2026

   ScreenConnect CVE-2026-84869 Wormable VBScript Attacks 🔗 https:// cybersecurefox.com/en/screenco nnect-cve-2026-84869-wormable-vbscript # sc

   via Mastodon https://cybersecurefox.com/en/screenconnect-cve-2026-84869-wormable-vbscript

5. update from securityonline.info

   A critical ConnectWise ScreenConnect vulnerability, CVE-2026-84869, is actively exploited in the wild. Patch your servers now to stop remote

   securityonline.info · 31d ago · September 12th, 2026

   Patch your servers now to stop remote

   via Mastodon https://securityonline.info/connectwise-screenconnect-vulnerability-cve-2026-84869/?utm_source=mastodon&utm_medium=jetpack_social

6. update from securityweek.com

   ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks

   securityweek.com · 29d ago · September 14th, 2026

   ConnectWise has released urgent patches for a critical-severity vulnerability in the ScreenConnect remote access and support software that has been exploited in worm-like attacks. Tracked as CVE-2026-84869 (CVSS score of 9.9/10), the security defect is described as a missing authorization and improper privilege management issue. The bug creates “a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances,” ConnectWise explains in its advisory . In early September, cybersecurity firm Huntress warned that the vulnerability has been exploited in the wild since August 20. As part of the observed incidents, a modified ScreenConnect instance was used to deploy four VBScript files designed to establish persistence and propagate to other ScreenConnect clients. The hackers used social engineering to trick victims into executing rogue ScreenConnect clients, which then checked for active sessions to push the VBScript payload to connected targets. ConnectWise resolved the flaw in ScreenConnect version 26.6.5 and urged users to apply the fixes as soon as possible. As a temporary mitigation, it recommends disabling the TransferFiles permission in ScreenConnect. “The ScreenConnect 26.6.5 patch includes updates to strengthen client and session handling for file-transfer and file-execution actions,” ConnectWise notes.

7. mentioned by radar.offseq.com

   ConnectWise ScreenConnect CRITICAL vuln (CVE-2026-84869) exploited in worm-like attacks — unauthorized file transfer & execution via remote

   radar.offseq.com · 29d ago · September 14th, 2026

8. mentioned by cyberworldops.eu

   ConnectWise patched CVE-2026-84869, a critical ScreenConnect authorization flaw allowing file transfer and execution via active sessions. Hu

   cyberworldops.eu · 29d ago · September 14th, 2026

9. mentioned by securityweek.com

   ScreenConnect critical flaw exploited in worm-like attacks

   securityweek.com · 29d ago · September 14th, 2026

10. update from beyondmachines.net

    ConnectWise Patches Critical ScreenConnect Flaw Exploited in Worm Attacks ConnectWise fixed a critical vulnerability (CVE-2026-84869) in Scr

    beyondmachines.net · 28d ago · September 15th, 2026

    ConnectWise Patches Critical ScreenConnect Flaw Exploited in Worm Attacks ConnectWise fixed a critical vulnerability (CVE-2026-84869) in Scr

    via Mastodon https://beyondmachines.net/event_details/connectwise-patches-critical-screenconnect-flaw-exploited-in-worm-attacks-n-t-h-f-x/gD2P6Ple2L

11. update from bleepingcomputer.com

    Critical ScreenConnect flaw now actively exploited in attacks

    bleepingcomputer.com · 27d ago · September 16th, 2026

    Cybersecurity and Infrastructure Security Agency (CISA). ConnectWise shared temporary mitigation measures for this missing-authorization flaw on September 7, advising security teams to disable TransferFiles permissions to block potential attacks. The vulnerability (now tracked as CVE-2026-84869 and patched in ScreenConnect 26.6.5 and later) affects ScreenConnect clients and can let threat actors with basic privileges transfer or execute files in low-complexity attacks that don't require user interaction. CISA added the security flaw to its catalog of actively exploited flaws on Friday and ordered U.S. federal agencies to secure their systems against ongoing attacks within three days. "These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise." Since 2024, CISA has flagged four ScreenConnect security issues as actively exploited, two of which have also been abused in ransomware attacks. Internet threat watchdog Shadowserver now tracks over 1,000 ScreenConnect instances still unpatched and exposed to attacks online, most of

12. mentioned by www.bleepingcomputer.com

    "Critical ScreenConnect flaw now actively exploited in attacks" "[...] Cybersecurity and Infrastructure Security Agency (CISA). Attackers no

    www.bleepingcomputer.com · 27d ago · September 16th, 2026

13. mentioned by www.bleepingcomputer.com

    🤖 CVE-2026-84869: critical missing-authorization flaw in ConnectWise ScreenConnect under active exploitation, per CISA. Low-complexity attac

    www.bleepingcomputer.com · 27d ago · September 16th, 2026

14. mentioned by www.bleepingcomputer.com

    Critical # ScreenConnect flaw now actively exploited in attacks https://www. bleepingcomputer.com/news/secu rity/cisa-warns-of-hackers-explo

    www.bleepingcomputer.com · 26d ago · September 17th, 2026