Act today High Known exploited Patch available CVSS 9.9
New detail: ScreenConnect attacks use a patched flaw, not a new one
The Hacker NewsConnectWise ScreenConnectCVE-2026-84869
What happened. Blackpoint Cyber reports the campaign against ConnectWise ScreenConnect exploits CVE-2026-84869 (CVSS 9.9), a now-patched flaw. It is not a new vulnerability. The recovered attacker toolkit, called SCKit, could turn support sessions into attack paths into managed service provider customers.
Who is affected. Users of ConnectWise ScreenConnect, especially managed service providers. Industrial sites that use it for remote support are exposed, because vendors and engineers often reach plant systems through it.
What to do. Check whether you run ConnectWise ScreenConnect and confirm it has the patch for CVE-2026-84869, including at service providers that reach your site.
When to act. Act today: Remote-support sites running ScreenConnect: the flaw is being exploited, so check and patch today.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L4
- L3.5
Why: ScreenConnect is remote-support software, which sits in the industrial DMZ (L3.5) or business network (L4) and is used to reach plant systems.
- Are you exposed?
Search your inventory and your providers' tools for ScreenConnect, and check whether each instance has the fix for CVE-2026-84869.
- If you cannot fix it yet
- Limit who can connect through ScreenConnect and require multi-factor authentication for every support account.
- Keep the remote-support server off the plant network until it is patched.
- Ask service providers to confirm their ScreenConnect instances are patched before they connect.
- Watch for
- New or unexpected ScreenConnect sessions, users or extensions on your remote-support servers.
- Remote-support activity from provider accounts at unusual times or toward plant systems.
- ATT&CK for ICS
- T0866Exploitation of Remote ServicesT0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Hacker News (opens thehackernews.com)
Vendor advisory: connectwise.com