Updated

Updated · Computerworld · Sep 11

ConnectWise Patches ScreenConnect Flaw CVE-2026-84869 in Version 26.6.5 After 5-Day Warning

Updated

Updated · Computerworld · Sep 11

ConnectWise Patches ScreenConnect Flaw CVE-2026-84869 in Version 26.6.5 After 5-Day Warning

Q: How many networks were silently backdoored by this worm-like ScreenConnect exploit before administrators could even apply the latest patch?

There is no verified count. Based on the reporting available, Huntress confirmed only that it saw the worm-like ScreenConnect activity in three unrelated incidents across several different organizations in August 2026. Neither Huntress nor ConnectWise has published a number of networks “silently backdoored” before the patch was available. That distinction matters. ConnectWise has patched CVE-2026-84869 in ScreenConnect client version 26.6.5 and Huntress said the observed behavior aligns with the flaw, but ConnectWise has not publicly confirmed how many environments were compromised through it. Separate reporting noted nearly 6,000 ScreenConnect instances exposed online, but that is exposure data, not a victim count. What is documented is the scope of observed cases: three attack chains using social engineering to deploy rogue ScreenConnect clients, which then pushed VBScript payloads to newly connected hosts in a worm-like manner. Huntress described that as capable of turning a compromised endpoint into a propagation point for additional systems, but it did not release a total number of affected networks. So the most accurate answer is that the total remains unknown publicly; the only confirmed figure in the reporting is three observed incidents, not a comprehensive victim count.

1 articles · Updated · Computerworld · Sep 11

Version 26.6.5 and later patch CVE-2026-84869, a critical ScreenConnect authentication failure that could let attackers transfer and execute files in active remote sessions without authorization or confirmation.
Sept. 3 marked ConnectWise’s initial warning to customers, when it told administrators to remove the “TransferFiles” permission from any users with an open support or access session until a fix arrived.
ScreenConnect has faced repeated security pressure: ConnectWise said in August it was recovering from a May 2025 nation-state attack that affected several customers, though it reported no customer losses.
The patch also follows a 2024 incident in which ConnectWise issued another ScreenConnect fix after reports the product had already been exploited.