A Critical ScreenConnect Vulnerability Is Already Being Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has reported that attackers have begun actively exploiting a critical vulnerability in the ConnectWise ScreenConnect remote access platform. The flaw has been assigned the identifier CVE-2026-84869 and was fixed in version 26.6.5 and later.

What the vulnerability is

The issue stems from a missing authorization check and improper privilege management. In CISA's wording, the flaw allows files to be transferred and executed within an active remote session without authorization and without confirmation from the host. The attack is low in complexity and requires no user interaction — basic privileges are enough.

Back on September 7, ConnectWise published interim mitigations, advising that the TransferFiles permission be disabled to block potential attacks. This past Friday, CISA added the vulnerability to its catalog of actively exploited flaws and directed U.S. federal agencies to close it within three days.

The scale of the threat

The Shadowserver monitoring service counts more than a thousand instances of ScreenConnect that are still unpatched and reachable from the internet. Most of them are in North America (758) and Europe (180).

For ScreenConnect, this is far from the first trouble. Since 2024, CISA has flagged four vulnerabilities in the product as actively exploited, two of which were used in ransomware attacks. In 2024, another flaw (CVE-2024-1709) was exploited both by the North Korea–linked group Kimsuky and by several ransomware gangs.

The list of incidents doesn't end there. Last year, ConnectWise had to rotate its code-signing certificates after presumably state-sponsored hackers breached its systems through a ViewState vulnerability (CVE-2025-3935) and gained access to the cloud instances of a limited number of customers. And in March, the company patched yet another vulnerability (CVE-2026-3564), tied to cryptographic signature verification, that allowed unpatched servers to be hijacked.

The stakes are high: ConnectWise's services are used by more than 100,000 IT providers worldwide. Many managed service providers (MSPs) and corporate IT teams use ScreenConnect to diagnose, patch, and maintain systems — which means the vulnerability opens attackers a path straight into a multitude of other organizations' infrastructures.

Source: Bleeping Computer