ScreenConnect Worm: A 9.9 Hole in the Support Tool Your MSP Runs on Your Machines

ConnectWise has patched a CVSS 9.9 hole in ScreenConnect that attackers have been riding since late August, turning the remote support tool many African businesses depend on into a self-propagating worm.

Your MSP probably uses ScreenConnect. So does your payroll provider, your backup vendor, and the three-person IT shop that keeps your branch network alive. That is what makes CVE-2026-84869, a 9.9-severity flaw ConnectWise patched this month, a problem for every business that outsources its desktop support, not just the ones running the software.

The bug is a missing authorization check in the ScreenConnect client. Under certain circumstances, an attacker with an active remote session can transfer files onto the connected machine and execute them without any confirmation from the person on the other end of the session. No prompt. No host approval. The file lands and runs.

How the worm spreads

Huntress, which caught the exploitation early, reported that attackers have been exploiting the flaw in the wild since August 20. The pattern they observed goes like this: an operator talks a victim into running a rogue ScreenConnect client through social engineering. That client, once live, scans for other active sessions on the same instance and pushes four VBScript files at each connected target. The scripts establish persistence and look for more sessions to poison. Each compromised helpdesk machine becomes the next distribution point.

Note what the initial access is not: a zero-day against your firewall. Somebody is talked into running a program. The worm does the rest of the work sideways, through a tool your organization already trusts and already allows through the perimeter.

What ConnectWise and CISA say

ConnectWise fixed the flaw in ScreenConnect version 26.6.5, which ships hardened handling for client and session file-transfer and file-execution actions. Until you can upgrade, the vendor’s interim advice is to disable the TransferFiles permission in ScreenConnect, which cuts off the propagation path even on a vulnerable version.

Last Friday, CISA added CVE-2026-84869 to the Known Exploited Vulnerabilities catalog, which binds US federal agencies to a three-day patch window under BOD 26-04. That deadline is a fair proxy for how seriously the rest of us should treat it, regardless of jurisdiction.

What African enterprises should do this week

1. Ask your MSP the question directly: what version of ScreenConnect (or ConnectWise Support, which bundles it) do you run against my environment, and when was it last patched? A vendor that cannot answer in an hour is telling you something.
2. Inventory the trust path. Remote support tools are domain-admin-adjacent by design. If ScreenConnect is allow-listed through your firewall and proxy, everything that walks through it inherits that trust.
3. Block rogue clients at the endpoint. The attack starts with a manually-run executable. AppLocker or equivalent application control stops the first step of this kill chain dead.
4. Watch for the VBScript signature. Four .vbs files landing in quick succession on helpdesk workstations is not normal behavior and is easy to write a detection rule for.

The bigger picture for a support-heavy market

Outsourced IT carries a lot of weight in the South African SME market. The economics make sense, but every outsourced relationship imports the vendor’s patch hygiene into your risk posture. Worm propagation through ScreenConnect has been a recurring theme in this product line for years. The difference this time is how fast it moves: the exploit has been live since August 20, and CISA’s three-day federal clock reflects how little grace period a self-propagating worm leaves anyone.

eHawu’s network-layer platform is built for this blind spot: continuous external visibility into the attack surface your vendors create on your behalf, so you know which support portals, session hosts, and administrative tools are exposed at any moment. Trust your MSP, then verify the version number.