ScreenConnect’s KEV clock is today. Cloud “no action” does not reinstall the host client.

CVE-2026-84869, CVSS 9.9, forensic triage Yes. Huntress aligned worm-like VBScript spread to a client file-transfer bug. 26.6.5 is the patch. The server was never the vulnerable piece.

RWP Ventures · 2026-09-14 · event 2026-09-08 · 14 min read · priority 8.6

CISA added the CVE to KEV on 11 September. Federal due date is today, 14 September. Forensic-triage flag: Yes. Ransomware-use flag: Unknown. Catalog version is still 2026.09.11. That due date is the operational sentence, not a new victim census overnight. Huntress documented three unrelated August incidents in which modified ScreenConnect clients pushed a four-stage VBScript chain (1.vbs–4.vbs) onto newly connected hosts. John Hammond told Help Net Security the observed automatic file-transfer-and-execute pattern aligns with this CVE. ConnectWise Priority is 1 High — targeted, or higher risk of being targeted.

Cloud “no action is required” applies to ConnectWise-hosted servers. It does not reinstall host clients or access agents. On-prem partners still have to upgrade the server to 26.6.5 and then refresh every client. Patching the control plane without hunting wscript.exe children of ScreenConnect.WindowsClient.exe is not remediation.

What happened

Huntress published on 3 September that the same pattern was showing up on unrelated endpoints in different organizations: rogue ScreenConnect clients repeatedly spawning wscript.exe to run 1.vbs, 2.vbs, 3.vbs, and 4.vbs. Initial access in the three cases was social engineering — a Quick Assist tech-support scam, a phishing-delivered MSI, and a fake Geek Squad refund form — which is ordinary RMM abuse. What was not ordinary was the next hop. Once a modified client was in an active session, it treated every new Host connection as a delivery path for the same VBScript chain. Huntress called that worm-like. ConnectWise published a same-day advisory on file-transfer behavior in Support and Access sessions (cloud and on-prem) and said a CVE and a fix would follow within the week. The interim control was strip TransferFiles from roles that had an open session.

On 8 September ConnectWise shipped 26.6.5, assigned CVE-2026-84869, and wrote that earlier client builds processed file-transfer actions through an active remote session without proper authorization or Host confirmation. Under those conditions a Guest-side actor in the session can transfer a file to the Host and execute it. Cloud servers were updated on ConnectWise’s side. On-prem needs 26.6.5 or later. Huntress updated its post that evening to name the CVE and the 9.9 score.

CISA listed the CVE on 11 September with a three-day BOD 26-04 clock and forensic triage. SecurityWeek and heise carried the worm-like / KEV combination into 14 September English coverage. NHS England’s CC-4848 (9 September) rated the operational threat Medium and pointed at the same bulletin. None of that is a new campaign diary. It is the due-date morning for an RMM client bug RWP had scored as a runner-up on 12 and 13 September.

This is not February 2024. CVE-2024-1709 / CVE-2024-1708 (SlashAndGrab, authentication bypass on the server setup wizard) is background. It is not evidence that 84869 is the same bug. 84869 is a client file-transfer/execute condition that needs an active session. Do not collapse them.

Why it matters

Three facts should not be collapsed.

First: PR:L is not “safe.” The vector is network, complexity is low, no user interaction, scope changed, all three CIA legs High. The privilege requirement is a Guest already in an active Support or Access session. That is the default shape of a tech-support scam and of a rogue RMM implant. Huntress’s three incidents did not start with this CVE. They started with social engineering that put a ScreenConnect client on the box. The CVE is what turns that client into a spreader onto the next Host that connects. Treat it as a session-to-host execution bug in the tool MSPs already trust, not as an unauthenticated internet RCE.

Second: the server sentence is a trap. ConnectWise is explicit that servers are not impacted. Cloud customers are told no server-side action is required. Both statements can be true and still leave every unrefreshed host client and access agent on a vulnerable build. 26.6.5 on the on-prem console does not rewrite the client binaries already installed on technician laptops and customer endpoints. ConnectWise’s own cloud paragraph, after “no action is required,” tells you to reinstall host clients and update access agents. That second sentence is the close.

Third: KEV forensic triage Yes means hunt before you declare patched. BOD 26-04’s three-day clock for FCEB is today. Private-sector MSPs are not FCEB. They run the same client. Huntress’s recommendation for hosts that already ran the chain is reimage from known-good media, not “upgrade and move on.” The 26.6.5 patch does not uninstall WindowsServiceHost Run keys, does not delete %TEMP%\value.txt / map.txt / out.enc / runner.ps1, and does not recall a Guest that already pushed 1.vbs. Same sentence we used for [Cisco FMC on 10 September](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/) and [GitLab on 12 September](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/): the patch does not clean a box that already ran attacker code.

We have no confirmed OT, ICS, or physical-process impact. A ScreenConnect session into a plant, a water utility, or a hospital biomedical shop is still an IT compromise of remote access at an industrial or clinical organization. Do not write a process event.

Who / what is affected

Technical context

RWP is not reproducing session file-transfer requests, Guest-to-Host execution actions, or a modified-client build. ConnectWise’s public description is enough for a defender: earlier Client Support and Access session builds processed file-transfer actions without the authorization and Host confirmation the product’s operators expect. Scope is Changed because the Guest in the session can affect the Host. Disabling file-transfer permissions reduces exposure until 26.6.5 is on the clients that actually run.

Huntress’s public chain, which we treat as reported tradecraft in the incidents they saw, not as a universal 84869 exploit kit:

• ScreenConnect.WindowsClient.exe (or related client binaries) spawning wscript.exe
• staged scripts named 1.vbs through 4.vbs (host profiling including security-product enumeration and RAM checks; Dropbox-staged map.txt; encrypted out.enc; runner.ps1 / PyTorchFix.ps1)
• persistence via HKCU\Software\Microsoft\Windows\CurrentVersion\Run → WindowsServiceHost pointing at WindowsServiceHost.vbs
• ScreenConnect audit-log classes Huntress told operators to inspect: RunFiles / RanFiles tied to a Guest process

ATT&CK mapping for what is stated, not a hypothetical ransomware playbook:

• Initial access that Huntress actually saw: user execution / social engineering that installed a rogue ScreenConnect client (T1204, T1219)
• The CVE itself, as ConnectWise described it: ingress tool transfer and execution through an existing remote session (T1105, T1059), with changed scope onto the Host
• Follow-on in the Huntress cases: VBScript (T1059.005), Registry Run key (T1547.001), lateral tool transfer onto newly connected Hosts (T1570)
• Follow-on that is not claimed for this CVE: ransomware, named actor, OT logic change

Public Huntress hashes for the August cluster, for hunting, not for decoration: 1.vbs 08bc4e82883eb42fc5219b206555b7a02a879860c76b4a12b2f82a64f6cc9020; 2.vbs de3b6836a88ae4b117e3b6de0e9cce3cd56a2b27b462d69e50c2fcac4089a457 and 19a3534da9f60c726be426ec5cc2b72c2d1254fefa0782bd2f08ef08117f3260; 3.vbs 110fffc85370bb7cc60fa023447165c7e99175473d76bc5ffb2abecaa3a41d66; 4.vbs de89d560fc8302c778d88e3938327b240fa0db9a64fc1d5643067eedcbd2aede; WindowsServiceHost.vbs ffd6d23f579571cc61936145791975da78b6ae914d780a9447a8f53c3688a0de. Malicious ScreenConnect instance ID in that write-up: 7a4d7d66502d4260. Huntress also listed 45.13.237.190, 131.123.40.98:8041, 146.59.55.107, 45.32.192.150, 15.204.185.204, tele-sync.opik.net, and borertors92.anondns.net as attacker infrastructure in those incidents. Filenames will change. wscript.exe as a child of a ScreenConnect client will not.

Threat / exploitation status

High confidence on: CVE identifier, CVSS vector, client-not-server scope, 26.6.5 as the fixed line, KEV dates and forensic-triage flag, ConnectWise Priority 1 High, Huntress’s published IOCs for the August cluster. Moderate confidence that the Huntress worm-like pattern is the activity CISA is counting as “known exploited” (Hammond’s alignment statement plus KEV timing; CISA did not publish a victim list). Low confidence on remaining unpatched on-prem and stale-client population, and on whether a second cluster exists past Huntress’s three incidents.

What defenders should do

1. Inventory every ScreenConnect deployment you actually run — cloud, on-prem, Automate-integrated, and every MSP that has a session into you. Version on the server is necessary and not sufficient. Record host-client and access-agent build. Include jump boxes, technician laptops, and vendor-support images. 26.6.5 or later on the console with old clients in the field is still open.

1. Patch, then refresh clients. On-prem: upgrade to ScreenConnect 26.6.5 or later, then reinstall host clients and update access agents per ConnectWise’s published procedures. Cloud: the server is already on the fixed build; still reinstall host clients and update access agents. Out-of-maintenance on-prem licenses do not get a free pass — restore maintenance or isolate. ConnectWise says 26.6.5 strengthens client and session handling for file-transfer and file-execution actions. Confirm the client build, do not trust the server banner.

1. If you cannot finish the client refresh today: ConnectWise’s workaround is disable TransferFiles on affected session roles. That is exposure reduction. It does not close a Guest that already had the permission, and it does not clean a Host that already ran a script.

1. Hunt. Forensic triage is Yes. Before you close the ticket: ScreenConnect audit logs for unexpected RunFiles / RanFiles from a Guest; ScreenConnect.WindowsClient.exe / ScreenConnect.Client.exe spawning wscript.exe or powershell.exe; 1.vbs–4.vbs, WindowsServiceHost.vbs, %TEMP%\value.txt, %TEMP%\map.txt, %TEMP%\out.enc, %TEMP%\runner.ps1; HKCU\...\Run\WindowsServiceHost; ScreenConnect instance IDs you did not issue, including 7a4d7d66502d4260; connections to the Huntress IPs and domains above. Huntress’s line for hosts that already ran the chain is reimage from known-good media or a clean OS install. We will not soften that into “run a cleaner.”

1. Do not confuse this with SlashAndGrab. Looking for SetupWizard.aspx/ and zeroed user.xml timestamps is the 2024 server playbook. 84869 hunting is client process trees and session file-run audit. Use the 2024 guide only if you also still have an ancient on-prem server in scope for those CVEs.

1. Sequence the rest of today’s KEV clock. [GitLab CVE-2026-85706](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/) is also due today — hunt the commits API; GitLab.com is already patched. [PaperCut CVE-2026-81578 / CVE-2026-82078](/posts/2026-09-11-papercut-ai-agent-campaign/) share the date; that campaign was 11 September’s Daily Top. MikroTik CVE-2026-86060 / CVE-2026-67277 were due yesterday. [Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/), NetScaler CVE-2026-19490, and Fortinet CVE-2025-25249 were due 12 September. Artifactory CVE-2026-42016 / 42018 due 25 September. [Check Point CVE-2026-85102 / 85103](/posts/2026-09-13-checkpoint-vpn-cve-2026-85102-85103/) are still not on KEV as of 2026.09.11. They remain unauthenticated VPN RCE with an NCSC-NL imminent-exploitation warning. They are not today’s due-date RMM client.

This is not an exploitation guide. Use ConnectWise’s bulletin and Huntress’s IOC table.

RWP assessment

Score 8.6. A CVSS 9.9 KEV with forensic triage, due today, in the RMM client that MSPs leave connected for a living, is the first material development after [yesterday’s Check Point VPN assessment](/posts/2026-09-13-checkpoint-vpn-cve-2026-85102-85103/). RWP had not published a full 84869 article. We scored it 8.1 as a runner-up on 12 and 13 September: session-required, servers not impacted, Huntress alignment reported, no overnight victim increment. The increment today is the BOD 26-04 due date plus the cloud-“no action” / stale-client failure mode, not a new named crew.

It does not outrank an unauthenticated GitLab file-read that was already [12 September’s story](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/). BleepingComputer’s 14 September GitLab recap is CISA restating KEV. No new versions, no new victim picture. Do not republish it.

It outranks GrayRabbit / Sogou CVE-2026-51990 (Gen Digital 10 September; BleepingComputer 13 September). UNC3569, China-aligned per Google Threat Intelligence, one-click RCE via sgbiz: into an unsandboxed Chromium 80 webview, GRAYRABBIT backdoor. Tencent patched in April (16.3.0.3498). Not KEV. Regional IME install base. Real espionage telemetry. Not today’s enterprise RMM due date.

It outranks Artifactory CVE-2026-42016 / 42018 (KEV 11 September, due 25 September, triage No on the rows we read). Continuation of the 12 September runner-up. Hunt it on the 25th.

It outranks Check Point 85102/85103 recycles in English this morning. That was yesterday. Still no KEV row. Still no confirmed exploitation.

Sunday-into-Monday KEV catalog has not moved past 2026.09.11. We are not manufacturing a new listing.

What we are watching

• Whether Huntress, ConnectWise, or a national CERT publishes a victim count past the original three incidents.
• Whether the KEV ransomware-use flag flips, or a named affiliate (including crews that already live in rogue ScreenConnect) claims 84869.
• On-prem 26.6.5 coverage versus cloud tenants that never refreshed host clients.
• Stale Automate-integrated and out-of-maintenance on-prem consoles.
• Whether CISA lists Check Point 85102 / 85103.
• GitLab 85706 hunting results now that the due date is here.
• Artifactory 42016 / 42018 through 25 September.

Sources

• ConnectWise — ScreenConnect 26.6.5 security bulletin (8 September 2026)
• ConnectWise Advisories — CVE-2026-84869 disclosure
• CVE.org — CVE-2026-84869
• NVD — CVE-2026-84869
• CISA Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04
• Huntress — Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity
• SecurityWeek — ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks (14 September 2026)
• Help Net Security — Attackers use rogue ScreenConnect clients to spread malware
• The Hacker News — Rogue ScreenConnect Clients Spread Four-Stage VBScript Chain
• The Hacker News — CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV
• NHS England — CC-4848, ScreenConnect 26.6.5
• heise — Cyber attacks on GitLab, ConnectWise ScreenConnect and JFrog Artifactory (14 September 2026)
• [RWP Daily Top, 13 September 2026 — Check Point CVE-2026-85102 / 85103](/posts/2026-09-13-checkpoint-vpn-cve-2026-85102-85103/)
• [RWP Daily Top, 12 September 2026 — GitLab CVE-2026-85706](/posts/2026-09-12-gitlab-cve-2026-85706-path-traversal/)
• [RWP Daily Top, 11 September 2026 — PaperCut AI-agent campaign](/posts/2026-09-11-papercut-ai-agent-campaign/)
• [RWP Daily Top, 10 September 2026 — Cisco FMC CVE-2026-20079](/posts/2026-09-10-cisco-fmc-cve-2026-20079-exploitation/)