ConnectWise ScreenConnect Client Unauthorized File Transfer and Execution

#Requires -RunAsAdministrator
# Check-CVE-2026-84869.ps1
# Detects vulnerable ScreenConnect client installations (< 26.6.5)
# Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN

$found = $false
$vulnerable = $false
$minSafe = [version]'26.6.5'

# Check installed programs (both 32-bit and 64-bit registry hives)
$regPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

foreach ($path in $regPaths) {
    Get-ItemProperty -Path $path -ErrorAction SilentlyContinue |
        Where-Object { $_.DisplayName -match 'ScreenConnect' } |
        ForEach-Object {
            $found = $true
            $ver = $null
            try { $ver = [version]$_.DisplayVersion } catch {}
            if ($ver -and $ver -lt $minSafe) {
                Write-Host "VULNERABLE - ScreenConnect client $($_.DisplayVersion) found: $($_.DisplayName)" -ForegroundColor Red
                $vulnerable = $true
            } elseif ($ver) {
                Write-Host "PATCHED - ScreenConnect client $($_.DisplayVersion) found: $($_.DisplayName)" -ForegroundColor Green
            }
        }
}

# Also check running service
$svc = Get-Service -Name 'ScreenConnect Client*' -ErrorAction SilentlyContinue
if ($svc) {
    $proc = Get-Process -Name 'ScreenConnect.ClientService' -ErrorAction SilentlyContinue
    if ($proc) {
        $fileVer = $proc.MainModule.FileVersionInfo.FileVersion
        try {
            $fv = [version]$fileVer
            if ($fv -lt $minSafe) {
                Write-Host "VULNERABLE - Running ScreenConnect client service version $fileVer" -ForegroundColor Red
                $vulnerable = $true
                $found = $true
            } else {
                Write-Host "PATCHED - Running ScreenConnect client service version $fileVer" -ForegroundColor Green
                $found = $true
            }
        } catch {}
    }
}

# Check for rogue indicators (IOCs from Huntress campaign)
$rogueKey = Get-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'WindowsServiceHost' -ErrorAction SilentlyContinue
if ($rogueKey) {
    Write-Host "WARNING - Rogue persistence key 'WindowsServiceHost' detected in HKCU Run. Possible worm campaign IOC!" -ForegroundColor Yellow
}

if (-not $found) {
    Write-Host "UNKNOWN - No ScreenConnect client installation detected on this host."
    exit 2
} elseif ($vulnerable) {
    exit 1
} else {
    exit 0
}