CVE-2026-84869 (CVSS score: 9.9) is at the center of a campaign that turns legitimate ScreenConnect support sessions into potential multi-customer attack paths, security researchers say.
How SCKit weaponizes ScreenConnect's Run Command and an older CVE
Blackpoint Cyber's Adversary Pursuit Group (APG) recovered a toolkit — dubbed SCKit — that leverages two paths: a now-patched vulnerability and built‑in remote-management features. APG told The Hacker News the recovered toolkit exploits CVE-2026-84869, "an improper privilege management and missing authorization vulnerability that could allow an attacker to file transfer and execute through an active remote session without authorization or host confirmation." The company added: "Our testing confirmed that the exploit targets CVE-2026-84869 and that the existing patch successfully blocks it."
Beyond that exploit, SCKit uses ScreenConnect's native Run Command functionality to run an attacker-controlled MSI ("sc.msi") after confirming a ScreenConnect installation is present. The MSI drops a batch script ("sckit-run.bat") that contacts ns.mo7sen[.]dev to fetch a PowerShell decoder ("sckit-decoder.ps1") and then deploys multiple components: a persistent-install script ("SilentForceInstall-WithUninstall.ps1") that adds two unauthorized ScreenConnect Access clients, and assorted scripts and C# code designed to interfere with legitimate Guest sessions.
RelayTrap and the reverse pivot to technician workstations
One named SCKit capability, RelayTrap, is built to reverse-pivot: rather than merely blocking administrators from an infected machine, RelayTrap "positions the malware to intercept legitimate support connections" and to use technician access as a bridge. If the toolkit succeeds in replacing the legitimate ScreenConnect Guest, it can attempt the CVE-associated guest‑to‑host file execution technique and send the SCKit payload back to the connecting technician for execution.
Once executed on a technician's workstation, the toolkit shifts focus to session theft. SCKit searches local browser data and process memory to recover authenticated ScreenConnect management sessions (noted in the reporting as .ASPXAUTH cookies). With those recovered sessions and the technician's existing management permissions, attackers can distribute commands across additional endpoints the technician controls — and, the researchers observed, do so under the NT AUTHORITY\SYSTEM context because the commands run through existing ScreenConnect agents.
Blackpoint described the tactic succinctly: "By first attempting to compromise a technician's workstation, then recover their authenticated ScreenConnect session, SCKit seeks to turn access to a single managed endpoint into an opportunity to reach other systems under that technician's control."
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePatch status, CISA action, and ConnectWise mitigations
Blackpoint's testing indicates that a fully patched ScreenConnect client prevents execution of the exploit payload tied to CVE-2026-84869. CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities (KEV) catalog on September 11, 2026, and federal agencies were required to apply the fixes by September 14, 2026.
ConnectWise has taken precautionary steps in response to the latest incident by disabling five third-party extensions in partner environments. Blackpoint said it found no technical link between those disabled extensions and SCKit. When contacted, a ConnectWise spokesperson told The Hacker News the company is "aware of reports of malicious activity affecting a limited number of ScreenConnect partners and that it's actively investigating the incident." The spokesperson added that ConnectWise has "disabled the identified extensions where we can take action as a precaution and are advising on‑premises partners to disable them immediately."
As of the reporting, there is no evidence that SCKit has successfully propagated to technician workstations or that it has bypassed the vendor patch for CVE-2026-84869.
Huntress disclosure: RMM+ authentication flaw in versions 1.0.31 and 1.0.32
In a later update, Huntress identified a serious authentication issue in RMM+, one of the five third‑party extensions that ConnectWise blocked. Huntress reported that when an administrator had not configured an access key, the extension would accept a blank one, "potentially allowing unauthorized commands to execute without going through ScreenConnect's normal authentication controls." RMM+ authenticates requests with a shared access key ("RMMPlus.AccessKey") stored in the extension settings; in versions 1.0.31 and 1.0.32, the key defaults to a blank value.
Because RMM+ operates outside ScreenConnect's normal accounts, roles, and authentication controls, Huntress said an attacker could execute commands on devices without needing to bypass multi-factor authentication. "Commands reached endpoints across several ScreenConnect instances within minutes. There was no corresponding login activity and the commands appeared in the logs reviewed linked to RMM+," the update said.
What this means for MSPs, security teams, and federal agencies
- MSPs: Investigate the management relationship, not only the endpoint. Blackpoint advised looking for rogue Access installations, reviewing administrative command history, examining technician workstations, and searching browser session artifacts if support personnel have connected to a suspected system.
- Security teams: Apply the available ScreenConnect patch — Blackpoint confirmed it blocks the CVE‑linked exploit — and add safeguards around operator sessions. The researchers recommended "stronger operator-session protections, including tighter session validation and additional authentication for bulk administrative actions."
- Federal agencies: CISA placed CVE-2026-84869 on its KEV list on September 11, 2026, with a remediation deadline of September 14, 2026; that action underlines the federal compliance requirement tied to the vulnerability.
SCKit is notable not because it invents a new flaw but because it combines a high‑severity, now‑patched vulnerability with techniques that exploit legitimate remote‑support functionality and third‑party extensions. The advisory record leaves one practical investigative gap: Blackpoint and Huntress have described capabilities and a likely attack sequence, but, as APG principal analyst Nevan Beal cautioned, "Identifying patient zero would require additional forensic evidence from affected environments." The immediate takeaways are concrete: patch the CVE, scrutinize third‑party extensions, and treat validated operator sessions as high‑value targets.
