Advisory · CVE-2026-84869
Attackers can push and run files through ScreenConnect sessions
A missing-authorization flaw in the ScreenConnect client lets an attacker transfer and execute files through an active remote session without host confirmation. ConnectWise fixed it in ScreenConnect 26.6.5; CISA confirms active exploitation.
- Vendor
- ConnectWise
- Product
- ScreenConnect
- Identifier / CWE
- CVE-2026-84869
CWE-269, CWE-862 - Action timing
- Oct 2, 2026
Explain it like I’m five
A support technician's toolbox lets them hand files to any computer they are helping. The lock on that drawer is broken, so anyone sitting at the technician's desk can hand out files, and the receiving computers accept them without asking the person using them.
- 01Active session
An attacker has or abuses an active ScreenConnect remote session to a client machine.
- 02Authorization skipped
The client fails to enforce authorization and host confirmation on file transfer and execution actions.
- 03Files pushed
The attacker transfers files to the connected endpoint through the session.
- 04Payload executes
The files execute on the endpoint, giving the attacker code execution on the managed machine.
What happened
ConnectWise’s September 8, 2026 security bulletin describes a condition in the ScreenConnect client that may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ConnectWise classifies the flaw as missing authorization (CWE-862) with improper privilege management (CWE-269) and scores it CVSS 9.9. ScreenConnect servers are not impacted. All ScreenConnect versions prior to 26.6.5 are affected. Huntress reported exploitation in the wild beginning August 20, 2026, with attackers pushing malicious VBScript payloads to newly connected systems and propagating to other ScreenConnect clients. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 11, 2026.
What to do
- Upgrade on-premises ScreenConnect servers to 26.6.5, then reinstall host clients and update access agents; cloud instances were updated automatically by ConnectWise.
- If patching is delayed, deselect the TransferFiles permission for every role under Administration > Security > Roles as a temporary mitigation. This reduces exposure but is not a substitute for the update.
- Review users with ScreenConnect access: remove unrecognized accounts, review roles and permissions, reset passwords, and enable MFA.
- Review audit logs for unauthorized file transfer or execution activity around active sessions, and follow incident response procedures if compromise is suspected.
Management note
ScreenConnect is trusted remote-access infrastructure: a flaw in its session authorization turns a support tool into a malware delivery channel across every managed endpoint. Exploitation was observed in the wild weeks before the patch, and CISA has flagged it as actively exploited. Treat this as an emergency change, not a routine patch cycle item.