ConnectWise ScreenConnect bug exploited in the wild, CISA says

The Cybersecurity and Infrastructure Security Agency (CISA) confirmed that a critical ConnectWise ScreenConnect bug was exploited in the wild.

In adding the CVSS 9.9 flaw to its known exploited vulnerabilities (KEV) catalog on Sept. 11, CISA said CVE-2026-84869 was an improper privilege management and missing authorization bug that could let attackers "transfer and execute files via an active remote session without authorization or host confirmation."

CISA has added four ScreenConnect flaws to the KEV since 2024, two of which were exploited by ransomware groups.

ConnectWise released a patch for this most recent flaw on Sept. 8.

Related reading:

Security pros said given the compressed timeline between disclosure, exploitation, and ransomware attacks today, it’s only a matter of time before this could become yet another ransomware case.

“The ScreenConnect vulnerability lets attackers with basic privileges transfer and execute arbitrary files without authorization or user interaction,” said Shane Barney, chief information security officer at Keeper Security. “That's a direct path to ransomware deployment. The CVSS 9.9 score was assigned because the combination of low complexity, no user interaction and unauthenticated file execution compresses the window between discovery and ransomware weaponization into weeks, not months.”

Barney added that ransomware gangs actively monitor the KEV catalog, and once a flaw lands there, the patch window becomes exponentially smaller. Barney said for managed service providers (MSPs), the risk compounds because a compromised instance doesn't just threaten one organization: it threatens the entire downstream chain of clients relying on that MSP for access.

“Organizations need to prioritize this patch above the standard quarterly or monthly rhythm most operate from,” said Barney. “If immediate patching is not possible, segregate ScreenConnect instances from sensitive network segments, disable TransferFiles permissions as a temporary measure and monitor for any exploitation attempts. Organizations with unpatched instances exposed to the internet are at elevated risk.”

John Strand, owner at Black Hills Information Security, said there are two important points to take from this flaw: First, the amount of time between vulnerability disclosure and active exploitation has gotten ridiculously short. Organizations simply don’t have the luxury of spending weeks testing patches before rolling them into production. Strand said ScreenConnect customers shoul patch right away.

“Don’t wait, get it patched,” said Strand.

The second issue Strand noted was the broader shift from on-prem technologies to cloud-based SaaS. Strand said he’s still shocked at how slowly many organizations are making that transition, especially for products that already have mature SaaS offerings.

“There have always been legitimate reasons for keeping certain technologies on-prem, but some of those reasons are starting to disappear pretty quickly in the face of the attack vectors we’re seeing today,” said Strand. “At some point, organizations have to weigh the risks of moving to the cloud against the growing security burden of maintaining and patching these systems themselves.”

Andrew Obadiaru, vice president and CISO at Cobalt, explained that ScreenConnect has been a recurring target for both ransomware crews and state-backed groups since 2024, and that's not really about ConnectWise's code quality: it’s that to an attacker, ScreenConnect represents a pre-established, trusted channel into thousands of environments that IT teams already rely on daily.

“Once you can transfer or execute files inside an active session without authorization, you're not breaking in, you're riding in on credentials the system already trusts,” said Obadiaru. “That's the pattern defenders need to internalize. Attackers increasingly go after the tools that sit at the center of trusted relationships between vendors, MSPs, and their customers, because compromising one instance can cascade across every downstream client it touches.”