ScreenConnect Under Deadline: Remote Support Needs Stronger Control

What Happened

CISA added CVE-2026-84869 to its KEV (Known Exploited Vulnerabilities) catalog. This means the vulnerability is already being exploited in real attacks and should be treated as a high priority.

The issue affects ConnectWise ScreenConnect, a widely used remote access and support tool. ConnectWise released a fix in version 26.6.5, and all versions before it are considered affected.

The vulnerability may allow files to be transferred and executed through an active remote session without host approval in certain circumstances. It is rated 9.9 under CVSS (Common Vulnerability Scoring System).

Why the Deadline Matters

When CISA adds a vulnerability to the KEV catalog, organizations should no longer treat it as a theoretical risk. The question becomes operational: are we using an affected version, is the system exposed and are there signs of abuse.

The 14 September deadline puts the issue into urgent review mode. For U.S. federal agencies, this is a specific action deadline. For other organizations, it is a strong prioritization signal, because ScreenConnect is often used by IT teams, support providers, MSPs (Managed Service Providers) and external partners.

Remote support is a sensitive control point. It provides a legitimate path into endpoints, servers and user environments. If this path is abused, attacker activity may appear as normal administrative access.

What the Risk Looks Like

ScreenConnect is not an ordinary application. It is a tool used to manage other systems. The issue is therefore not only the vulnerability itself, but the level of trust the organization has already granted to the tool.

During an active session, the ability to transfer and execute files without additional approval may be used to:

• place malicious scripts;
• run commands on connected devices;
• spread to other systems;
• create persistence;
• bypass standard approval procedures;
• disguise actions as legitimate remote support.

Huntress described separate incidents in which malicious ScreenConnect clients were used to spread a four-stage VBScript chain to newly connected systems. These cases show how quickly a legitimate support tool can become a channel for malicious activity.

The Important Distinction

ConnectWise states that ScreenConnect servers are not affected by the vulnerability itself. The issue is in the client and how file-transfer and file-execution actions are handled during an active session.

This distinction matters, but it does not reduce the need for review. In many environments, remote support clients are installed on endpoints and servers with high operational value. If such a client is abused, the impact may extend beyond one device and affect the broader supported environment.

That is why the right response is not only “update to version 26.6.5.” Teams should review which sessions were active, which files were transferred, which commands were executed and whether unusual processes appeared after remote access.

What Organizations Should Check

Practical checks:

• whether the organization uses ConnectWise ScreenConnect;
• whether any installations run versions before 26.6.5;
• which endpoints and servers have the ScreenConnect client installed;
• which providers and administrators have remote access rights;
• whether active or recently ended sessions exist around the risk window;
• whether files were transferred without a clear business reason;
• whether scripts were launched, especially through wscript.exe or PowerShell;
• whether new services, startup tasks or system directory changes exist;
• whether connections to unknown external infrastructure appear;
• whether logs are sufficient for retrospective investigation.

The key question is not only “did we update ScreenConnect.” It is “can we prove remote access was not abused before the update.”

DIAMATIX Comment

From the DIAMATIX perspective, this vulnerability shows why remote support tools must be monitored as a critical part of security.

These tools are built to help IT teams. But because they have high access, they are valuable to attackers as well. If an organization does not monitor who connects, what is transferred, what is executed and when, remote support can become a blind spot.

SOC (Security Operations Center) and MDR (Managed Detection and Response) processes help connect signals from endpoints, accounts, remote sessions, file changes, logs and network activity. This allows teams to distinguish legitimate support from behavior that needs investigation.

For actively exploited vulnerabilities, fast updating is mandatory, but it is not enough. It should be followed by checks for abuse, persistence and lateral movement to other systems.

Questions for CISO, IT and MSP Teams

• Where do we use ScreenConnect and who manages it?
• Are all installations updated to version 26.6.5 or later?
• Do we have a list of all devices with the ScreenConnect client?
• Which external providers have remote support rights?
• Are file transfers and file execution actions approved?
• Do we review sessions, files and processes after remote access?
• Can we detect wscript.exe, PowerShell or unusual scripts launched through such a session?
• Do we have a plan to isolate a device if abuse is suspected?
• Are logs sufficient to reconstruct the timeline?

The practical takeaway: remote access should be convenient for IT teams, but provably controlled for the business.

Check whether remote support is under control

DIAMATIX can help assess risk in remote access tools, exposure, logs, administrator privileges and response readiness for actively exploited vulnerabilities.

Request a remote access security review with DIAMATIX.
Trusted · Innovative · Vigilant

Sources

• ConnectWise. ScreenConnect 26.6.5 Security Bulletin.
• ConnectWise. ScreenConnect Remote Access: Guest File Transfer Advisory.
• CISA. Known Exploited Vulnerabilities Catalog — CVE-2026-84869.
• NHS England Digital. ConnectWise Releases Security Update for ScreenConnect.
• CVE Program. CVE-2026-84869.
• Huntress. Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity.
• The Hacker News. CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV.

This article summarizes publicly available information as of September 2026.