Loading story…
ConnectWise released ScreenConnect version 26.6.5 to address CVE-2026-84869, a critical authentication failure in its remote-access product. The Canadian Centre for Cyber Security reported that open-source reporting showed active exploitation of the flaw in the wild as of September 8, while CSO Online reported that the issue had remained unresolved for five days before the patch was issued.
Organizations running ScreenConnect versions earlier than 26.6.5 should promptly apply the vendor's security update and review ConnectWise security bulletins for associated guidance. Because ScreenConnect provides remote administrative access, defenders should also investigate for unauthorized access or anomalous activity on exposed ScreenConnect infrastructure, particularly where patching was delayed.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CISA added ConnectWise ScreenConnect vulnerability CVE-2026-84869 to its Known Exploited Vulnerabilities catalog after reports of active exploitation. It set a September 14 federal remediation deadline for affected agencies.
The Canadian Centre for Cyber Security published advisory AV26-903 for CVE-2026-84869 in ConnectWise ScreenConnect and urged users to review vendor guidance and apply updates.
Open-source reporting indicated that CVE-2026-84869, affecting ConnectWise ScreenConnect, was actively exploited in the wild.
Huntress reported that attackers had exploited CVE-2026-84869 since August 20 using modified ScreenConnect clients. The rogue clients used social engineering and deployed VBScript payloads for persistence and propagation to other connected ScreenConnect clients.
ConnectWise released ScreenConnect version 26.6.5 to address the critical authentication-related vulnerability affecting earlier versions. A separate report said the patch arrived five days after the issue was identified or reported.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
7 references tracked. Mallory keeps watching after this page renders.
securityweek.com
Open sourceacn.gov.it
Open sourcethreataft.com
Open sourcecsoonline.com
Open sourcetenable.com
Open sourcemalware.news
Open sourcecyber.gc.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**ConnectWise ScreenConnect** disclosed a critical vulnerability, **CVE-2026-3564** (**CVSS 9.0**), affecting versions prior to **26.1**. The flaw stems from ScreenConnect storing unique per-instance machine keys and related cryptographic material in plaintext server configuration files, creating a path for attackers under certain conditions to extract those keys and abuse them for unauthorized access. The issue is classified as **CWE-347: Improper Verification of Cryptographic Signature**, and successful exploitation can undermine confidentiality, integrity, and availability in environments that rely on ScreenConnect for remote access. With the exposed machine keys, an attacker could forge or manipulate session authentication tokens, hijack legitimate sessions, and elevate access without user interaction. ConnectWise rated the issue as high priority, and the **Centre for Cybersecurity Belgium** urged organizations to patch immediately, monitor for suspicious activity, and treat updates as protection against future exploitation rather than proof that no prior compromise occurred. The vendor states the issue is fixed in **version 26.1**, making rapid remediation and post-patch review important for on-premises deployments.
Jul 23, 2026
ConnectWise released a security update for ScreenConnect to address a critical vulnerability, tracked as CVE-2025-14265, which affects the server component of the remote access platform. The flaw, caused by improper code integrity validation during extension installations (CWE-494), could allow attackers with authorized or administrative access to expose sensitive configuration data and install untrusted extensions. The vulnerability carries a CVSS 3.1 base score of 9.1, highlighting its severity, though ConnectWise reports no evidence of active exploitation at this time. The issue impacts all ScreenConnect versions prior to 25.8, and the 25.8 patch enforces stricter server-side validation and integrity checks for extension installations. ConnectWise has automatically applied updates to cloud-hosted ScreenConnect instances, while on-premises users must manually upgrade to version 25.8. Partners using Automate integration are advised to update their Automate ScreenConnect Extension before upgrading ScreenConnect itself. Security advisories from both ConnectWise and the Canadian Centre for Cyber Security urge organizations to prioritize patching to prevent potential unauthorized access and maintain secure remote management environments. The vulnerability is rated as Priority 2 – Moderate, with a recommended update window of 30 days, but immediate action is encouraged due to the risk of sensitive data exposure.
Jun 29, 2026
ConnectWise confirmed active exploitation of two critical vulnerabilities in **ScreenConnect** affecting versions earlier than `23.9.8`, led by `CVE-2024-1709`, an authentication bypass rated `CVSS 10.0`, and `CVE-2024-1708`, a path traversal flaw. Researchers reported that attackers could reach the setup wizard, overwrite the internal user database, create administrator accounts, and then abuse the product’s extension mechanism to execute code on the host, including **SYSTEM-level** remote code execution. ConnectWise said its incident response team had validated compromises, while cloud-hosted instances were updated automatically and on-premises or self-hosted customers were told to upgrade immediately. Huntress and Rapid7 published technical details showing exploitation was straightforward and urgent, increasing the risk to unpatched systems within hours of disclosure. Huntress said suspicious activity could include unusual requests to `SetupWizard.aspx` with trailing path segments and unexpected file changes in the `App_Extensions` directory, where malicious extensions may be planted for persistence or code execution. The vendor’s emergency fix in **ScreenConnect 23.9.8** closed both flaws, but the rapid weaponization highlighted the exposure of remote management platforms widely used by enterprises and managed service providers.
Aug 21, 2026