SCKit
CVE-2026-84869Allows attackers to transfer and run files through remote sessions without host approval.
A privilege and authorization flaw in the ScreenConnect client lets files be moved and executed during active remote sessions without the host's consent. ConnectWise ScreenConnect users are affected, but servers are not. The vulnerability is actively being exploited, and CISA has added it to its known-exploited list, meaning attackers are using it.
ConnectWise ScreenConnect · Updated 13 Nov · From the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 11 Sept; US agencies must fix by 14 Sept
SeveritycriticalCVSS 9.9 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the vendor's fix when it becomes available.
- Monitor remote sessions for unexpected file transfers or program launches.
- Restrict ScreenConnect client use to authorized networks until a fix is released.
- Review ConnectWise guidance for any workarounds.
What happened
- 11 SeptCISA added CVE-2026-84869 to its known-exploited list and mandated US federal agencies fix by September 14.
- 12 NovBleepingComputer reported a new worm-like malware called 'SCKit' targeting MSPs in ScreenConnect attacks.
- 12 NovThe Hacker News reported SCKit malware turns ScreenConnect support sessions into potential MSP attack paths.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-84869 | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | critical 9.9 | 11 Sept | 0.9% |
Our reporting
We have not reported on it. It is here because CISA added it to its list of flaws under attack.
Reported elsewhere
BleepingComputer · 12 NovNew worm-like 'SCKit' malware targets MSPs in ScreenConnect attacks ↗The Hacker News · 12 NovSCKit Malware Turns ScreenConnect Support Sessions Into Potential MSP Attack Paths ↗The records
CISA known-exploited catalog ↗CVE-2026-84869 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free