CVE-2026-84869: ConnectWise ScreenConnect Actively Exploited — Detection and Remediation Guide for Defenders

On September 11, 2026, CISA added CVE-2026-84869 to the Known Exploited Vulnerabilities (KEV) catalog, confirming that a pair of flaws in ConnectWise ScreenConnect — improper privilege management combined with missing authorization — is being actively exploited in the wild right now. This is not a theoretical exposure. Attackers are abusing ScreenConnect to push files and execute code through active remote sessions without host authorization or end-user confirmation.

For any organization running ScreenConnect — and for the MSPs and IT departments that rely on it to manage hundreds or thousands of endpoints — this is a worst-case scenario: the very tool designed for trusted remote administration is being turned into an unauthorized command-and-control channel. ScreenConnect sits deep inside the network with privileged access to managed hosts, which means successful exploitation translates directly into code execution on endpoints, lateral movement, staging for ransomware, or data exfiltration — all under the guise of legitimate remote support traffic.

If ScreenConnect is present anywhere in your environment, treat this as an active incident until you can prove otherwise: patch immediately, audit session history for unauthorized activity, and hunt for evidence of post-exploitation. CISA's Binding Operational Directive BOD 26-04 applies to federal civilian agencies, but the guidance — prioritize by risk, apply vendor mitigations, or discontinue use — is sound advice for every organization.

Technical Analysis

Affected Product and Components

The vulnerability affects ConnectWise ScreenConnect, the remote access and remote support platform widely deployed by MSPs, IT departments, and help desks. Both cloud-hosted and self-hosted (on-premises) ScreenConnect servers are in scope. Organizations should inventory every ScreenConnect component in their estate, including:

• ScreenConnect server instances (cloud and self-hosted), including the Session Manager service (ScreenConnect Session Manager, running under dotnet on Windows servers)
• Access agents deployed to managed endpoints (ScreenConnect.ClientService.exe on Windows, equivalent agents on macOS and Linux)
• Support/backstage clients used by technicians (ScreenConnect.WindowsClient.exe)
• Legacy or forgotten agents on endpoints no longer actively managed — these are frequently the unpatched foothold attackers find first

The Vulnerability: Improper Privilege Management + Missing Authorization

CVE-2026-84869 chains two weaknesses:

1. Improper Privilege Management (CWE-269): ScreenConnect fails to correctly constrain the privileges applied within session contexts, allowing actions to be performed at a higher privilege level than the initiating party should hold.
2. Missing Authorization (CWE-862): Critical operations — specifically file transfer and command execution through an active remote session — are performed without a proper authorization check against the initiating identity, and critically, without host-side confirmation from the end user.

From a defender's perspective, the exploitation requirements and observable chain are what matter:

• Attack chain: The attacker gains access to a ScreenConnect session context (via compromised technician credentials, an exposed server, session token theft, or an unattended access session). Because of the missing authorization check, they can invoke file transfer and command execution against the managed endpoint without the host user's consent prompt — the guardrail that normally alerts an end user to file drops and commands is bypassed.
• Observed post-exploitation behavior: Attackers use this to drop payloads to endpoint temp/user-writable directories (commonly %TEMP%, %AppData%, C:\ProgramData, or C:\Users\Public) and execute them via the ScreenConnect service context, which typically runs with elevated privileges (SYSTEM on Windows).
• Why it's dangerous: Because the execution flows through legitimate ScreenConnect binaries and signed processes, naive allowlisting and reputation-based controls will not flag it. Detection must focus on behavior: the ScreenConnect service spawning command interpreters, scripting engines, or unsigned executables.

Exploitation Status

• Confirmed active exploitation: Yes — CISA KEV inclusion on 2026-09-11 is definitive confirmation of in-the-wild abuse.
• Public PoC: Treat exploitation capability as widespread; KEV-listed remote-access-tool flaws are historically weaponized within days for ransomware pre-positioning and access brokerage.
• Threat profile: Remote access tooling abuse is a staple of ransomware affiliates, initial access brokers, and financially motivated actors. Expect double-extortion staging, credential theft, and persistence installation through this vector.

Required Action per CISA

Per the KEV entry, organizations must:

1. Apply vendor mitigations in accordance with ConnectWise's instructions for CVE-2026-84869.
2. Comply with BOD 26-04 (Prioritizing Security Updates Based on Risk) guidance, including CISA's Forensics Triage Requirements — meaning you preserve and triage forensic evidence from potentially impacted systems before or alongside remediation.
3. For cloud services: follow applicable BOD 26-04 cloud guidance.
4. If mitigations are unavailable: discontinue use of the product. This is not optional for federal agencies, and private-sector organizations should apply the same standard — an unpatched ScreenConnect instance under active exploitation is a liability, not an asset.

Detection & Response

The most reliable detection surface is behavioral: ScreenConnect processes performing actions consistent with unauthorized file transfer and execution. Key observables:

• ScreenConnect.ClientService.exe spawning command interpreters (cmd.exe, powershell.exe, pwsh.exe, wscript.exe, rundll32.exe, mshta.exe) — legitimate technician sessions do this too, so correlate with session audit logs and authorized change windows.
• File drops into user-writable or staging directories immediately followed by execution under the ScreenConnect service context.
• ScreenConnect service activity on endpoints or servers where no authorized support session was scheduled.
• Unusual outbound connections or session activity from the ScreenConnect server outside business hours.

The Sigma rules below are tuned to be high-fidelity when correlated with your authorized-session schedule. Deploy them, but pair them with ScreenConnect session audit log review — the vendor's audit trail is the authoritative record of who initiated what.

---
title: ScreenConnect Service Spawning Command Interpreter or Scripting Engine
id: 3f9c1a72-6e84-4b2d-9c51-7a8f2e5d4b33
status: experimental
description: Detects ScreenConnect client service spawning command interpreters, scripting engines, or LOLBins, consistent with unauthorized command execution via CVE-2026-84869 exploitation of ScreenConnect sessions.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1219/
author: Security Arsenal
date: 2026/09/12
tags:
  - attack.execution
  - attack.t1059
  - attack.t1219
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\regsvr32.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Legitimate technician activity during authorized support sessions — correlate with ScreenConnect session audit logs and change windows
level: high
---
title: Executable Dropped to Staging Directory Followed by ScreenConnect Session Activity
id: 8b2d5f41-1c93-4a7e-b6d2-9f4e3c7a1d58
status: experimental
description: Detects executable files written to common attacker staging directories by the ScreenConnect service, consistent with unauthorized file transfer through an exploited remote session (CVE-2026-84869).
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/12
tags:
  - attack.command_and_control
  - attack.t1105
logsource:
  category: file_event
  product: windows
detection:
  selection_source:
    Image|endswith:
      - '\ScreenConnect.ClientService.exe'
  selection_path:
    TargetFilename|contains:
      - '\Users\Public\'
      - '\ProgramData\'
      - '\AppData\Local\Temp\'
      - '\Windows\Temp\'
  selection_ext:
    TargetFilename|endswith:
      - '.exe'
      - '.dll'
      - '.ps1'
      - '.bat'
      - '.msi'
  condition: selection_source and selection_path and selection_ext
falsepositives:
  - Legitimate software deployment via ScreenConnect toolbox or file transfer during authorized sessions
level: high
---
title: Suspicious Encoded or Download Cradle Command Under ScreenConnect Session
id: c71e4b90-3d52-4f8a-a216-6b9d8e2f5c47
status: experimental
description: Detects encoded PowerShell, download cradles, or living-off-the-land download commands executed beneath a ScreenConnect process, indicating hands-on-keyboard post-exploitation via an unauthorized remote session.
references:
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-84869
  - https://attack.mitre.org/techniques/T1059/001/
  - https://attack.mitre.org/techniques/T1105/
author: Security Arsenal
date: 2026/09/12
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1105
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentCommandLine|contains: 'ScreenConnect'
  selection_cli:
    CommandLine|contains:
      - '-enc '
      - '-encodedcommand'
      - 'downloadstring'
      - 'downloadfile'
      - 'invoke-webrequest'
      - 'iwr '
      - 'curl.exe'
      - 'certutil -urlcache'
      - 'start-bitstransfer'
  condition: selection_parent and selection_cli
falsepositives:
  - Rare — legitimate technicians occasionally run scripted remediation; validate against session audit logs
level: critical

The following KQL query hunts Microsoft Defender for Endpoint and Sentinel telemetry for ScreenConnect processes spawning execution children, joined against common staging-directory file drops. Tune the lookback to cover the window since the KEV publication date (2026-09-11) at minimum — and ideally 30 days back, since exploitation may predate public disclosure.

// Hunt: ScreenConnect-spawned execution and staging file drops (CVE-2026-84869)
let Lookback = 30d;
let ScreenConnectProcs = dynamic(["ScreenConnect.ClientService.exe", "ScreenConnect.WindowsClient.exe"]);
let SuspiciousChildren = dynamic(["cmd.exe","powershell.exe","pwsh.exe","wscript.exe","cscript.exe","mshta.exe","rundll32.exe","regsvr32.exe","certutil.exe","bitsadmin.exe","curl.exe"]);
let ExecEvents =
    DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName in~ (ScreenConnectProcs)
    | where FileName in~ (SuspiciousChildren)
    | project ExecTime=TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256, ReportId, DeviceId;
let FileDrops =
    DeviceFileEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName in~ (ScreenConnectProcs)
    | where ActionType == "FileCreated"
    | where FolderPath has_any ("\\Users\\Public\\","\\ProgramData\\","\\AppData\\Local\\Temp\\","\\Windows\\Temp\\")
    | where FileName endswith_any (".exe",".dll",".ps1",".bat",".msi")
    | project DropTime=TimeGenerated, DeviceName, DroppedFile=FileName, FolderPath, SHA256, DeviceId;
ExecEvents
| join kind=leftouter FileDrops on DeviceId, $left.ExecTime between (datetime_add('minute', -10, $right.DropTime) .. datetime_add('minute', 10, $right.DropTime))
| summarize ExecCount=count(), DistinctChildren=dcount(FileName), Files=make_set(DroppedFile) by DeviceName, AccountName, InitiatingProcessFileName, bin(ExecTime, 1h)
| order by ExecCount desc;

For endpoint forensics at scale — particularly if you suspect pre-patch compromise and need to comply with CISA's Forensics Triage Requirements — the following Velociraptor artifact sweeps the fleet for ScreenConnect service activity, staging-directory artifacts, and unexpected child processes.

-- CVE-2026-84869 Triage: ScreenConnect process activity and staging artifacts
-- Deploy as a hunt across all Windows endpoints hosting ScreenConnect agents

LET processes <= SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)screenconnect'
   OR CommandLine =~ '(?i)screenconnect'

LET staging_files <= SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=[
  'C:/Users/Public/*.exe',
  'C:/Users/Public/**/*.exe',
  'C:/ProgramData/**/*.exe',
  'C:/Windows/Temp/*.exe',
  'C:/Users/*/AppData/Local/Temp/*.exe'
])
WHERE Mtime > now() - 2592000

SELECT 'PROCESS' AS ArtifactType,
       Exe AS Path, CommandLine AS Detail, Username AS Context, CreateTime AS Timestamp
FROM processes
UNION ALL
SELECT 'STAGED_FILE' AS ArtifactType,
       FullPath AS Path, format(format='%d bytes', args=Size) AS Detail,
       '' AS Context, Mtime AS Timestamp
FROM staging_files
ORDER BY Timestamp DESC

Remediation

1. Patch Immediately

Apply the vendor-supplied update for CVE-2026-84869 per the official ConnectWise security bulletin (available via the ConnectWise Trust Center and linked from the CISA KEV entry). For cloud-hosted ScreenConnect instances, confirm with ConnectWise that your instance has been patched — do not assume it has been; obtain written confirmation and the patched version number for your records. For self-hosted servers, upgrade to the fixed build and verify the version post-update. If no fix is available for your deployment model, discontinue use until one is — per CISA's own directive language.

2. Verify Version and Inventory the Agent Footprint

Use the following PowerShell to enumerate ScreenConnect presence and service versions across a host (run via your RMM/EDR at scale), and to confirm the server-side build:

# CVE-2026-84869 Verification & Triage Script — run elevated on each endpoint/server
# 1) Enumerate ScreenConnect services and their binary versions
Get-CimInstance Win32_Service |
  Where-Object { $_.Name -match 'ScreenConnect' -or $_.PathName -match 'ScreenConnect' } |
  ForEach-Object {
    $bin = ($_.PathName -replace '"','') -split ' ' | Select-Object -First 1
    [PSCustomObject]@{
      Hostname   = $env:COMPUTERNAME
      Service    = $_.Name
      State      = $_.State
      StartMode  = $_.StartMode
      BinaryPath = $bin
      Version    = if (Test-Path $bin) { (Get-Item $bin).VersionInfo.ProductVersion } else { 'NOT FOUND' }
    }
  } | Format-Table -AutoSize

# 2) Flag recently staged executables in common abuse directories (last 30 days)
$paths = @('C:\Users\Public','C:\ProgramData','C:\Windows\Temp',"$env:LOCALAPPDATA\Temp")
foreach ($p in $paths) {
  if (Test-Path $p) {
    Get-ChildItem $p -Recurse -Include *.exe,*.dll,*.ps1,*.bat,*.msi -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } |
      Select-Object FullName, LastWriteTime, Length
  }
}

# 3) Recent child-process evidence: ScreenConnect spawning shells (Sysmon Event ID 1, if deployed)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; Id=1; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match 'ParentImage.*ScreenConnect' -and $_.Message -match 'Image.*(cmd|powershell|pwsh|wscript|mshta|rundll32|certutil)' } |
  Select-Object TimeCreated, Message | Format-List

If any ScreenConnect service version predates the vendor's fixed build, treat the host as potentially compromised and proceed to step 4 before returning it to service.

3. Reduce the Attack Surface Now

• Enforce host-side confirmation: Where supported, require end-user consent for all session actions and disable unattended access on endpoints that don't strictly need it. The vulnerability specifically bypasses host confirmation — compensating controls that require explicit approval at the application layer reduce the blast radius until patching completes.
• Restrict server access: Limit ScreenConnect server administrative and relay interfaces to known technician networks via firewall policy; require MFA on all technician accounts and rotate credentials — compromised tech credentials are the most likely session-access vector.
• Segment managed endpoints: ScreenConnect agents give attackers a ready-made lateral movement path. Ensure managed endpoints cannot reach each other over SMB/RDP/WinRM unless operationally required.

4. Hunt Before You Trust

Because CVE-2026-84869 is confirmed actively exploited, patching alone is insufficient — assume exploitation may have occurred pre-patch. In line with CISA's Forensics Triage Requirements under BOD 26-04:

1. Export ScreenConnect session audit logs covering at least the past 90 days. Identify every session with file-transfer or command-execution activity and reconcile each against authorized support tickets and technician identities.
2. Deploy the detections above and run the KQL and Velociraptor hunts across your fleet.
3. Preserve forensic images of any host showing suspicious ScreenConnect-spawned execution before reimaging or cleanup.
4. Rotate credentials for any account whose endpoint shows evidence of unauthorized session activity — assume in-memory credential theft on any host where attacker commands executed under SYSTEM context.
5. Report confirmed compromises per your regulatory obligations and, for federal agencies, per BOD 26-04 reporting requirements.

5. Longer-Term Hardening

• Maintain a continuous inventory of remote access tooling (approved and shadow) — ScreenConnect, like any RMM-class tool, must be treated as Tier-0 infrastructure with the same patch urgency as domain controllers.
• Subscribe to CISA KEV feeds and automate KEV-to-asset matching in your vulnerability management program so additions like this one trigger immediate SLA-based patching.
• Evaluate EDR behavioral rules specifically targeting RMM abuse as a technique class, not just individual tools.

This vulnerability is a reminder that remote administration tooling is both indispensable and inherently dual-use. The organizations that come through this cleanly will be the ones that patched fast, hunted hard, and verified rather than assumed.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub