CVE-2026-84869

ConnectWise ScreenConnect Improper Privilege Management & Missing Authorization (CVE-2026-84869)

Privilege Escalation Initial Access Execution Last updated:

Detects exploitation of CVE-2026-84869, a KEV-listed improper privilege management (CWE-269) and missing authorization (CWE-862) vulnerability in ConnectWise ScreenConnect. Attackers abuse insufficient authorization checks on administrative/management endpoints to escalate privileges, create rogue administrative users, modify session-group permissions, or invoke privileged operations (remote command execution, extension upload) without proper authorization. Detection focuses on anomalous ScreenConnect web/service activity: unauthenticated or low-privilege access to admin API paths, privilege/role changes, new administrator provisioning, and remote command dispatch from the ScreenConnect service host.

Vulnerability Intelligence

KEV — Known Exploited

Affected Software

Vendor
ConnectWise
Product
ScreenConnect

Weakness (CWE)

CWE-269CWE-862

Timeline

Disclosed
September 11, 2026

CVSS

Unscored
CVSS vector not yet published
Write-up coming soon

What is CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management & Missing Authorization (CVE-2026-84869)?

ConnectWise ScreenConnect Improper Privilege Management & Missing Authorization (CVE-2026-84869) (CVE-2026-84869) maps to the Privilege Escalation and Initial Access and Execution tactics — the adversary is trying to gain higher-level permissions in MITRE ATT&CK.

This page provides production-ready detection logic for ConnectWise ScreenConnect Improper Privilege Management & Missing Authorization (CVE-2026-84869), covering the data sources and telemetry it touches: Microsoft Sentinel, IIS W3C Logs, Web Server Logs. The queries below are rated high severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Privilege Escalation Initial Access Execution
Microsoft Sentinel / Defender
kusto 
let adminPaths = dynamic(["/Administration", "/Services/PageService.ashx", "/Services/AuthenticationService.ashx", "/Services/SecurityService.ashx", "/App_Extensions/", "/SetupWizard.aspx"]);
let privKeywords = dynamic(["CreateUser", "AddUser", "SetRole", "SetPermissions", "AddSessionGroupRole", "UpdateSecurity", "CreateSession"]);
W3CIISLog
| where csUriStem has_any (adminPaths) or csUriStem has_any (privKeywords)
| where scStatus in (200, 302)
| where csMethod == "POST"
| extend SuspiciousUA = cUserAgent !has "Mozilla" or cUserAgent has_any ("python", "curl", "go-http", "okhttp")
| summarize Requests = count(), Paths = make_set(csUriStem, 20), UAs = make_set(cUserAgent, 10) by cIP, sSiteName, bin(TimeGenerated, 10m)
| where Requests >= 1
| project TimeGenerated, cIP, sSiteName, Requests, Paths, UAs

Identifies POST requests to ScreenConnect administrative and security service endpoints in IIS logs indicating attempts to invoke privileged operations without authorization.

high severity medium confidence

Data Sources

Microsoft Sentinel IIS W3C Logs Web Server Logs

Required Tables

W3CIISLog

False Positives

  • Legitimate ScreenConnect administrators performing user management from unusual source IPs
  • Automated ScreenConnect health-check or monitoring scripts using non-browser user agents
  • Managed service provider technicians provisioning new users during onboarding

Sigma rule & cross-platform mapping

The detection logic for ConnectWise ScreenConnect Improper Privilege Management & Missing Authorization (CVE-2026-84869) (CVE-2026-84869) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for CVE-2026-84869 Sigma rules on detection.fyi

Platform-specific guides for CVE-2026-84869

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-09-12 Research depth: standard
References (4)

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Simulated unauthorized POST to ScreenConnect security service endpoint

    Expected signal: IIS W3CIISLog entry with csMethod=POST, csUriStem=/Services/SecurityService.ashx, scStatus=200/302

  2. Test 2Scripted admin endpoint access with non-browser user agent

    Expected signal: Web/IIS log showing POST to /Administration with user agent python-requests

  3. Test 3ScreenConnect service spawning a command shell

    Expected signal: ProcessRollup2/Sysmon EventID 1 with ParentImage ScreenConnect.Service.exe and child cmd.exe

Response Playbook

Triage

  1. Confirm the ScreenConnect server version against the ConnectWise 2026-09-08 security bulletin to determine if the host is unpatched and exposed to CVE-2026-84869.
  2. Review IIS/web logs for the flagged source IP: enumerate all POST requests to /Services/SecurityService.ashx, /Services/AuthenticationService.ashx, /Administration and /App_Extensions/ and correlate with authenticated session identity.
  3. Inspect the ScreenConnect user store and audit log for newly created administrator accounts, unexpected role/permission changes, or session-group role modifications occurring near the suspicious requests.
  4. Determine whether the source IP is an expected administrator/MSP address or an untrusted external host.

Containment

  1. Isolate or take the ScreenConnect server offline from external access (block inbound to the management port at the firewall) until patched.
  2. Disable or delete any unauthorized administrator accounts and revoke active sessions and API tokens.
  3. Apply the ConnectWise fixed version from the 2026-09-08 bulletin and force credential rotation for all ScreenConnect admin accounts.

Evidence Collection

  1. Preserve IIS W3C logs, ScreenConnect application/audit logs (App_Data), and the user/role configuration database for the affected time window.
  2. Capture endpoint process telemetry for children of ScreenConnect.Service.exe and any uploaded extensions under App_Extensions/ for forensic analysis.

Escalation Criteria

  • ! Escalate to incident response if an unauthorized administrator account was created or a shell/scripting process was spawned by the ScreenConnect service.
  • ! Escalate if evidence shows remote command execution against managed endpoints or lateral movement stemming from the ScreenConnect host.

Investigation Guide

Forensic Artifacts

  • > IIS W3C access logs showing POSTs to ScreenConnect security/administration endpoints
  • > ScreenConnect audit logs and user/role database entries under App_Data
  • > Uploaded extension files under the App_Extensions/ directory
  • > Child process creation records where ParentBaseFileName is ScreenConnect.Service.exe

Tuning Guidance

Build an allowlist of known administrator/MSP source IP ranges and expected automation user agents, then filter those from the detection. Focus alerting on POST activity from external or first-seen IPs, non-browser user agents, and requests immediately followed by new-account creation or ScreenConnect.Service.exe spawning shell processes. If your organization does not expose ScreenConnect to the internet, tighten thresholds and treat any external hit as high fidelity.

Hunting Queries

Baseline all administrative endpoint POST activity to identify anomalous source IPs and scripted user agents interacting with ScreenConnect privileged services.

Hunting — KQL
kql 
W3CIISLog | where csUriStem has_any ("SecurityService.ashx","AuthenticationService.ashx","/Administration","/App_Extensions/") | where csMethod == "POST" | summarize count() by cIP, csUriStem, cUserAgent, bin(TimeGenerated,1h)
Hunting — SPL
spl 
index=web sourcetype IN ("iis","ms:iis:auto") http_method=POST uri_path IN ("/Services/SecurityService.ashx","/Services/AuthenticationService.ashx","/Administration") | stats count by src_ip, uri_path, useragent

Atomic Red Team Tests

Test 1 Simulated unauthorized POST to ScreenConnect security service endpoint
windows

Sends an unauthenticated POST to the ScreenConnect SecurityService endpoint to generate IIS telemetry matching the detection (lab server only).

Command

powershell 
powershell -c "Invoke-WebRequest -Uri 'https://sc-lab.local/Services/SecurityService.ashx' -Method POST -Body 'CreateUser=attacker&role=Administrator' -UseBasicParsing"

Cleanup

powershell 
powershell -c "Remove-Item -Path 'C:\\Program Files (x86)\\ScreenConnect\\App_Data\\testuser.tmp' -ErrorAction SilentlyContinue"

Expected Telemetry

IIS W3CIISLog entry with csMethod=POST, csUriStem=/Services/SecurityService.ashx, scStatus=200/302

Expected Detection

KQL/SPL/AQL/Sumo/Chronicle rules fire on the POST to the privileged endpoint.

Test 2 Scripted admin endpoint access with non-browser user agent
linux

Uses curl with a scripted user agent to hit the /Administration endpoint, simulating tooling-driven authorization bypass.

Command

bash 
curl -s -X POST -A 'python-requests/2.31' -d 'action=SetRole&user=svc&role=Administrator' https://sc-lab.local/Administration

Cleanup

bash 
echo 'no persistent artifact; server-side test account removed via console if created'

Expected Telemetry

Web/IIS log showing POST to /Administration with user agent python-requests

Expected Detection

Detection flags non-browser user agent POST to ScreenConnect administrative path.

Test 3 ScreenConnect service spawning a command shell
windows

Simulates post-exploitation remote command execution by having a process that mimics ScreenConnect service spawn cmd.exe (lab endpoint).

Command

powershell 
powershell -c "Start-Process -FilePath cmd.exe -ArgumentList '/c whoami'"

Cleanup

powershell 
echo 'no cleanup required; transient process'

Expected Telemetry

ProcessRollup2/Sysmon EventID 1 with ParentImage ScreenConnect.Service.exe and child cmd.exe

Expected Detection

CrowdStrike CQL and Elastic EQL sequence rules detect the privileged child process spawn.

Related Detections

Tactic Hubs

TA0004Privilege EscalationTA0001Initial AccessTA0002Execution

Related Techniques

T1068Exploitation for Privilege EscalationT1190Exploit Public-Facing ApplicationT1136.001Local Account

Same Tactic: Privilege Escalation

Popular Detections