Every ITSM team runs on remote support software. It’s how a technician fixes a laptop three states away, how an MSP manages a hundred client networks from one console, how “can you share your screen” turns into a resolved ticket. That trust is exactly why remote monitoring and management (RMM) tools have quietly become one of the most effective ways into a network — and a recently disclosed vulnerability in one of them shows how malicious code can spread between the very sessions it’s meant to service.

A Worm Inside the Tool You Use to Fix Other People’s Computers

In August, Huntress researchers began seeing an odd pattern across unrelated organizations: rogue ConnectWise ScreenConnect clients, planted through social engineering — a fake tech-support call, a phishing email with a malicious installer, a fraudulent refund-form lure — repeatedly launching Windows Script Host to run four staged VBScript files. Together, the scripts profiled the host, downloaded additional payloads, and helped establish persistence through a Run key disguised as a Windows service.

The detail that made this worth CISA’s attention: those same modified clients could pass the identical script chain to a different machine the moment a ScreenConnect connection was established with it. A technician’s ordinary remote support session became the delivery mechanism — worm-like spread carried entirely inside the tool built to help.

CVE-2026-84869 (CVSS 9.9) was added to CISA’s Known Exploited Vulnerabilities catalog on September 11. ConnectWise’s fix ships in version 26.6.5, and — notably — the advisory also calls for reinstalling host clients and updating access agents, since the vulnerability affects client-side file-transfer handling.

Why This Isn’t Really About ScreenConnect

This particular worm-like attack is new. The underlying problem isn’t. CISA, the NSA, and MS-ISAC issued a joint advisory back in 2023 specifically about legitimate RMM software being abused this way, and the reasoning still holds: abusing legitimate RMM software follows the same living-off-the-land principle as LOLBins — using trusted tools to carry out malicious activity. That trust can help attackers bypass security controls designed to catch unauthorized software. The tool isn’t inherently malware. It’s software that security teams often permit to operate across their environments.

Huntress also flagged something ITSM teams should sit with: some of the attacks involved a second remote access tool, UltraViewer. Environments rarely run exactly one remote access tool. Every one of them carries the same structural risk, whether or not it happens to be the one in the latest advisory.

What ITSM Teams Should Actually Do

• Patch and reinstall, don’t just update. Upgrade on-premises ScreenConnect installations to version 26.6.5 or later. Cloud deployments have already received the update, but both deployment types should reinstall host clients and update access agents. A server-side patch alone doesn’t remove an already-compromised client. For confirmed compromises, Huntress recommends reimaging affected hosts from known-good media.
• Inventory every RMM tool actually running, not just the ones on your approved list. An unauthorized second remote access tool sitting quietly on an endpoint is exactly the kind of thing that shows up after the incident, not before it.
• Restrict file-transfer permissions if you can’t patch immediately. ConnectWise recommends temporarily disabling the TransferFiles permission for all user roles when an update cannot be applied immediately. This is not a substitute for patching.
• Watch for the actual indicators, not just “is it patched.” A remote-support client spawning wscript.exe, or a Run key disguised as a Windows service pointing to a script in a user’s AppData folder, is a textbook post-exploitation persistence technique worth an alert regardless of which RMM vendor’s name is on the process.

The Bottom Line

The tools an ITSM team relies on to fix problems remotely are, structurally, also tools built to reach other machines remotely — which is precisely what makes them worth an attacker’s attention. “It’s just our remote support software” has never been a reason to patch it slower than anything else on the network. The latest ScreenConnect vulnerability is another reason to patch it faster.

Canio Campaniello is an offensive security researcher and the founder of Hackita.it, where he writes about the techniques attackers actually use once they’re inside a network.