Remote Access Without a Blind Spot: ScreenConnect CVE-2026-84869 and What SMBs Should Ask Their MSP

If your business depends on a managed service provider (MSP) — or you are the MSP — remote support tools are part of how work gets done. They are also part of how an attacker finishes the job after they land somewhere else.

On September 8, 2026, ConnectWise published a ScreenConnect security bulletin for version 26.6.5. On September 11, 2026, CISA added CVE-2026-84869 to the Known Exploited Vulnerabilities (KEV) catalog. CISA’s short description is clear: ScreenConnect contains improper privilege management and missing authorization issues that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.

ConnectWise rates the issue Priority 1 / High and says versions prior to 26.6.5 are impacted. Cloud instances were upgraded automatically; on-premises partners must upgrade and then reinstall host clients / update access agents.

Owner translation: The tool your technician uses to “take over the desktop” had a path where file transfer/execution might skip the usual host confirmation. That is not a theoretical CVE for a lab — CISA listed it because it is known to be exploited in the wild.

Why This Hits SMBs and MSPs Differently

Remote access sits on every critical PC. Finance laptops, EHR workstations, and the office manager’s machine often have a persistent agent.
Outsourcing does not outsource ownership. You still need written proof of version, patch date, and any temporary mitigations.
MSP-safe framing matters. This is not “fire your MSP.” It is “ask for evidence the same day CISA adds a KEV that touches your RMM.”

What ConnectWise Told Defenders

From the official bulletin:

Patch: ScreenConnect 26.6.5 (on-prem partners download and apply; cloud already updated).
After upgrade: Reinstall host clients and update access agents.
Temporary mitigation (not a substitute for patching): In Administration → Security → Roles, deselect the TransferFiles permission for each role/session group until you can upgrade.
Post-patch hygiene: Review users and roles, remove unrecognized accounts, change passwords, enable MFA.

The Ticket I Want Owners to Send Today

“Please confirm whether we use ConnectWise ScreenConnect (cloud or on-prem). If yes: current version number, date upgraded to 26.6.5 or later, confirmation that host clients/access agents were reinstalled or updated after the patch, whether TransferFiles was reviewed on each role, and whether any forensic/log review was done after CISA added CVE-2026-84869 to KEV on Sep 11, 2026. If we do not use ScreenConnect, name the remote-support product we do use and its current version.”

How This Fits Risk-Based Patching (Without Being a Federal Agency)

CISA’s KEV list and BOD 26-04 logic still help SMBs triage: internet-exposed or high-privilege remote-access tools jump the line; known exploitation jumps the line; “we monitor it” is not a closed ticket with evidence. Pair this with your asset inventory so the next KEV does not start from zero.

Need a calm second opinion on RMM exposure, MFA on remote tools, or vendor evidence for cyber insurance? CyberIntelPro / Security Medic works MSP-safe with Hudson Valley SMBs and their partners.

References

CISA Known Exploited Vulnerabilities Catalog — CVE-2026-84869 (added 2026-09-11): cisa.gov/known-exploited-vulnerabilities-catalog
ConnectWise, “ScreenConnect 26.6.5 Security Patch” bulletin (2026-09-08): connectwise.com/…/2026-09-08-screenconnect-bulletin
NVD, CVE-2026-84869: nvd.nist.gov/vuln/detail/CVE-2026-84869
CISA BOD 26-04: cisa.gov/…/bod-26-04