CISA's ScreenConnect Deadline Expired Two Days Ago. A Thousand Instances Are Still Exposed

CISA gave U.S. federal agencies three days to patch CVE-2026-84869 in ConnectWise ScreenConnect. That deadline expired on September 14. Two days later, the Shadowserver Foundation still counts more than a thousand unpatched, internet-exposed ScreenConnect instances — 758 of them in North America and 180 in Europe. The patch has been available since the beginning of the month. The attacks have been running since late August.

The gap between those two facts is the story. This is not a vulnerability waiting to be weaponised. It was weaponised first and catalogued afterwards, and the population that has not moved is the population that was always going to be hit.

What the flaw is

CVE-2026-84869 carries a CVSS score of 9.9. ConnectWise describes it as a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. CISA's catalogue entry classes it as improper privilege management and missing authorization.

That wording matters more than the number. This is not a memory-corruption bug. Nothing is being overflowed or corrupted. The software is doing what it was built to do — move a file across a remote session and run it — and simply failing to check whether it was supposed to. Attack complexity is low and no user interaction is required, which is what pushes the score to the top of the scale.

ConnectWise's own account of the fix is narrow and precise:

The ScreenConnect 26.6.5 patch includes updates to strengthen client and session handling for file-transfer and file-execution actions.

Before the patch shipped, the company's interim advice was to turn off the TransferFiles permission — an admission that the feature itself was the exposure.

The campaign found it before the catalogue did

Huntress reported the activity first, after seeing the same pattern across unrelated customer environments in late August; SecurityWeek dates the earliest activity to 20 August. What the researchers described was not an internet-wide scan for vulnerable servers. It began with social engineering — tech-support scams, phishing, poisoned search results — to get a rogue ScreenConnect client installed on one machine by a person who thought they were being helped.

From there the flaw did the rest. The rogue client pushed and ran scripts onto other endpoints connected to the same session infrastructure, giving the campaign a worm-like shape across hosts that had never been phished and had done nothing wrong.

That is the part worth sitting with. The initial access was ordinary and human. The propagation was a permissions bug in a tool whose entire purpose is to hold privileged access to other people's computers. ConnectWise says it serves more than 100,000 IT providers. A managed service provider's ScreenConnect deployment is, structurally, a list of every machine that provider can reach. An authorization failure inside that is not one compromised host; it is a fan-out.

This is also not the first time. Since 2024, CISA has flagged four separate ScreenConnect vulnerabilities as actively exploited, two of them abused in ransomware campaigns and one by the North Korea-linked Kimsuky group. Remote monitoring and management software is now a standing target category, for the obvious reason: it is pre-installed, pre-trusted, and pre-authorised on exactly the machines an intruder wants.

What defenders should do

Update ScreenConnect clients to 26.6.5. If that cannot happen immediately, disable the TransferFiles permission as ConnectWise advised. Patching closes the propagation path, but it does not undo anything that already happened, and the exploitation window here is roughly four weeks wide.

Huntress's guidance is that any on-premises ScreenConnect installation deserves extra scrutiny, and that hosts found to be affected should be rebuilt from known-good media or a clean operating system install rather than cleaned in place. Its published indicators are defensive and worth checking directly: unexpected Windows Script Host processes spawned by ScreenConnect, suspicious user run keys pointing at script files in AppData, ScreenConnect audit-log entries showing file-run actions attributed to a guest process, and secondary remote-access tools appearing alongside ScreenConnect without explanation. The full technical detail sits in the ConnectWise bulletin and the Huntress write-up.

The uncomfortable conclusion is not about ScreenConnect specifically. A KEV entry with a three-day federal clock is about as loud as the U.S. government gets about a piece of software, and a thousand-plus instances are still sitting on the internet unpatched after the clock ran out. The advisory system worked. The patching did not.

Sources: ConnectWise security bulletin, 8 September 2026 · Huntress: Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity · CISA Known Exploited Vulnerabilities Catalog · BleepingComputer: Critical ScreenConnect flaw now actively exploited in attacks · SecurityWeek: ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like Attacks · The Hacker News: CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEV