Campaign exploits CVE-2026-84869 in ScreenConnect; SCKit seeks to climb privileges and pivote

An active campaign against deployments of ConnectWise ScreenConnect (also known as ConnectWise Control) has been based on the exploitation of a already known and patched vulnerability, not a new failure. Blackpoint Cyber researchers have identified a malicious tool kit - called SCKit - that takes advantage of CVE-2026-84869 (CVSS 9.9), a missing privilege management and authorization failure that allows file execution from a remote active session without host confirmation. According to the company's shared evidence, the operation of the failure is blocked if the ScreenConnect client is fully patched, but the toolkit includes additional techniques to take advantage of already authenticated operator sessions, which increases the risk even if the patch is applied.

In proven terms: Blackpoint Cyber recovered and analyzed the toolkit and documented the following technical attack chain. The known explosion attempts a "guest-to-host file execution" associated with CVE-2026-84869; the kit also deploys components that install unauthorized access customers with NT AUTHORITY\ SYSTEM context and a function called RelayTrap designed to "reverse-pivot": infect the workstations of technicians who attempt to investigate a committed endpoint, using the remote support functionality itself as a propagation vector. ConnectWise has recognized the research and has preventative disable five third-party extensions in some partner environments while continuing to investigate.

Technically, the sequence that Blackpoint describes is as follows: the attacker uses the functionality of ScreenConnect's Run Command to check for a product installation, download an MSI installer controlled by the attacker (identified in the analysis as "sc.msi") that runs a batch dropper ("sckit-run.bat"); this download a PowerShell decoder ("sckit-decoder.ps1") from a controlled domain and, from there, unfolds several components - including a PowerShell / Guest script for a silent set of sessions that interferes with a Scryptoid # C. If you succeed in replacing the legitimate Guest, the toolkit tries to run the payload on the connecting technician's machine and recover authenticated sessions (e.g. cookies .ASPXAUTH) from process memory or browser data to move laterally.

These techniques combine vulnerability exploitation (patch-blocking) and abuse of legitimate product functionalities (not solved only with the patch). The real danger is that, if a legitimate operator already has an authenticated session against several client environments - as is often the case in MSPs - the tool can turn access to a committed endpoint into a door to reach other networks and equipment managed by that technician, distributing commands with SYSTEM privileges without setting a separate execution method on each machine.

Those who are affected: customers who use ConnectWise ScreenConnect / Control (particularly MSPs and their partners), the workstations of technicians who make remote connections and, by extension, the final customers managed by those technicians. In the case noted, Huntress also detected an authentication defect in the RMM + extension (versions 1.0.31 and 1.0.32) that accepted a blank access key if the administrator did not configure it, allowing to run commands without going through normal ScreenConnect authentication controls; ConnectWise has temporarily blocked several extensions as a preventive measure.

What is confirmed and what is not: it is confirmed that Blackpoint analyzed the toolkit and that its tests blocked the operation of CVE-2026-84869 in fully-parked customers; it is confirmed that the toolkit contains modules for persistence, to interfere with Guest sessions and to try to recover operator sessions. It is not confirmed, however, what was the initial access vector in the observed incidents - Blackpoint indicates that it could be related to malicious extensions but there is not enough forensic evidence to establish "patient zero" - and, until the report, there is no public evidence that the campaign has successfully spread intrusion to technical workstations or that it has won the CVE patch.

Practical consequences: in a successful scenario, an attacker can get persistence in managed endpoints, run code with system privileges, and use authenticated sessions of technicians to spread malware, steal session credentials and distribute payloads (ransomware, miners, data exfiltration). For organizations that delegate administration to MSPs this means that an incident in a single endpoint can climb into multiple client environments if operation sessions are not protected.

What organizations should do now (concrete and priority measures): 1) Apply patches immediately. Check that all ScreenConnect / ConnectWise Control components - servers and customers - are updated to the version that fixes CVE-2026-84869; Blackpoint tests indicate that the known explosion is blocked after updating. See the official information and the supplier's guides at the ConnectWise Trust Centre: https: / / www.connectwise.com / company / trust-center.

2) Disable or review third-party extensions. If you give on-premises instances, disable any third party extensions you do not need and audit those that are installed; ConnectWise has blocked some extensions as a precaution. Huntress has reported a specific failure in RMM + (v1.0.31 / 1.0.32) that deserves immediate attention and mitigation; see also sources from the extension provider or developer.

3) To detect and investigate signs of engagement. Look for technical indicators that Blackpoint has documented: records of unusual Run Command executions, MSI facilities with names such as "sc.msi," presence of files or scripts such as "sckit-run.bat," "sckit-decoder.ps1" or "SilentForceInstall-WithUninstall.ps1," outgoing communications to suspicious domains observed in the investigation, and creation of unauthorized Access customers. Isolate and preserve evidence before cleaning them to allow a forensic analysis.

(4) Strengthen protection of technical sessions and stations. Implement multifactor authentication for administrative accounts and, where possible, additional controls for mass administrative actions (revalidation, mandatory records). Minimise local privileges in technicians' machines and limit their range of administration by network segmentation. Monitor and restrict extensions that store shared keys or work outside the normal ScreenConnect authentication model.

5) Prepare response and notification. If you detect suspicious activity, isolate the affected endpoints, enable memory capture and relevant records, change credentials and tokens that may have been exposed, and coordinate the response with your MSP provider or incident response providers. For recommendations for incident response and good recovery practices, see official resources such as the catalogue of exploited vulnerabilities and the CISA guides: https: / / www.cisa.gov / knowledge-exploited-vulnerabilities-catalog and https: / / www.cisa.gov / stopransomware / identify-protect-detect-respond-recover.

To further review the technical analyses published by the teams investigating the campaign (e.g. Blackpoint Cyber and Huntress) and the official communications of ConnectWise. The evidence available reinforces a practical conclusion: parking is essential, but not enough on its own as long as the operator session processes, third party extensions and privilege policies continue to expose abuse vectors that allow an attacker to transform an endpoint committed to a ramp into other managed environments. Keep up-to-date inventories, strict access controls and monitoring of administrative activities as essential measures to reduce this risk.