CVE-2026-84869: ConnectWise ScreenConnect Unauthorized File Transfer & Execution

Overview

A critical vulnerability has been disclosed in ConnectWise ScreenConnect, one of the most widely deployed remote monitoring and management (RMM) tools used by managed service providers (MSPs) and enterprise IT teams. Tracked as CVE-2026-84869, the flaw combines improper privilege management (CWE-269) with missing authorization (CWE-862) in the ScreenConnect client, allowing file transfer and execution actions to be processed through an active remote Support or Access session without authorization or Host confirmation.

The issue has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and ConnectWise has assigned it Priority 1 — its fastest remediation tier, recommending organizations treat the fix as an emergency change.

Technical Details

How It Works

ScreenConnect Support and Access sessions normally require the Host (the machine being remotely accessed) to explicitly confirm file-transfer actions before files can move in or out of the session. The vulnerable client versions contain a condition where file-transfer requests can be processed through an active remote session without that authorization step or Host confirmation. Under certain circumstances, this allows an attacker with an existing low-privilege session to transfer files to the Host and execute them, including through elevated execution actions — effectively bypassing the human-in-the-loop control that ScreenConnect relies on to prevent unattended file execution.

Because ScreenConnect is routinely deployed with elevated access for legitimate remote administration, an attacker who can reach or hijack a session inherits substantial reach into the Host system.

Impact Assessment

Who Is At Risk

• Organizations running on-premises ScreenConnect client installations prior to version 26.6.5
• Host clients and access agents that have not been updated or reinstalled following vendor guidance, even after the server component is patched
• MSPs and IT teams using ScreenConnect for privileged remote support — a compromised session can translate directly into endpoint compromise across every managed client

Potential Attack Chains

1. Session Access — Attacker obtains or hijacks an active ScreenConnect Support/Access session (e.g., via stolen technician credentials or a rogue session)
2. Unauthorized File Transfer — Files are pushed to the Host without triggering the normal confirmation prompt
3. Elevated Execution — Transferred files are executed on the Host, potentially with elevated privileges
4. Fleet-Wide Compromise — Because RMM tools are used to manage many endpoints, a single abused session can be leveraged to push payloads across an entire client base

This mirrors the pattern seen in prior ScreenConnect incidents, including a May 2025 nation-state campaign and a separately exploited 2024 vulnerability — both patched, but both exploited in the wild before organizations updated.

Affected Versions & Fix

ConnectWise released the patch roughly five days after first warning customers about the underlying authentication/authorization weakness. During that window, the vendor's interim guidance was to manually remove the TransferFiles permission from open sessions.

Mitigation

Immediate Actions

1. Upgrade on-premises ScreenConnect installations to 26.6.5 or later immediately
2. Update and reinstall Host clients and access agents — the server-side patch alone does not remediate already-deployed clients
3. Cloud-hosted ScreenConnect environments have been updated by ConnectWise, but client/agent updates are still required
4. Where immediate patching isn't possible, remove the TransferFiles permission from active sessions as an interim control
5. Review session logs and technician identities for any signs of unauthorized file-transfer activity prior to patching

Detection Opportunities

• Unexpected file-transfer activity within ScreenConnect sessions, especially transfers not initiated by the Host
• Newly created or modified executables on Host endpoints correlated with ScreenConnect session timestamps
• Anomalous or unrecognized technician/session identities accessing client systems
• Elevated-privilege process execution immediately following a ScreenConnect session event

Defence-in-Depth

• Restrict which technicians/accounts can hold file-transfer permissions in ScreenConnect at all
• Enforce MFA and conditional access on ScreenConnect operator accounts to reduce the chance of session hijacking
• Segment and monitor endpoints managed via RMM tooling separately from general network telemetry
• Maintain an inventory of all ScreenConnect client/agent versions across managed endpoints — don't assume the server patch covers the fleet

Why This Matters for MSPs

RMM platforms like ScreenConnect are high-value targets precisely because they are trusted, privileged, and widely deployed across many downstream organizations. A vulnerability that lets file execution slip past the Host-confirmation control turns a single compromised or hijacked session into a potential foothold across an MSP's entire client base. Given the KEV listing, defenders should assume active or imminent exploitation and prioritize both the server patch and the often-overlooked client/agent update.

References

• ConnectWise-Advisories/Disclosures — CVE-2026-84869
• NHS England Digital — ConnectWise Releases Security Update for ScreenConnect
• NIST NVD — CVE-2026-84869
• CISA Known Exploited Vulnerabilities Catalog