ScreenConnect CVE-2026-84869: Files Pushed and Run Without Host Approval

On 8 September 2026 ConnectWise released ScreenConnect 26.6.5 to fix CVE-2026-84869, a client-side flaw that can let files be transferred to a host and executed during an active remote session without authorization or host confirmation. ConnectWise rates it CVSS 9.9. CISA added it to the Known Exploited Vulnerabilities catalog on 11 September with a federal due date of 14 September.

The detail that trips people up: the ScreenConnect server is not affected. The bug lives in the client that sits on every managed machine, so a server upgrade alone does not finish the job.

What's affected

ConnectWise's bulletin says all ScreenConnect versions before 26.6.5 are affected. The flaw is in the file transfer handling of Support and Access sessions. Under certain circumstances, files could be pushed to the host and run, "including through elevated execution actions", without the host side approving it. ConnectWise lists the weaknesses as CWE-862 (missing authorization) and CWE-269 (improper privilege management).

• Cloud: servers were already updated to 26.6.5. You still need to reinstall host clients and update access agents.
• On-premises: upgrade the server to 26.6.5 or later, then reinstall host clients and update access agents. ConnectWise says you must be on 25.4 or later to upgrade directly to 26.6.5, and that out-of-maintenance licenses must be renewed first.
• Automate-integrated on-premises: 26.6.5 is available through Automate Product Updates for partners with an active Automate Assurance subscription.

What the attacks looked like

ConnectWise has said little beyond the bulletin, citing "the sensitive nature of this vulnerability". The best public picture comes from Huntress, which reported the behavior before the CVE existed.

In late August, Huntress investigated three incidents at unrelated organizations. Each started with social engineering that led to a rogue ScreenConnect client on the victim machine, in one case after the user ran Windows Quick Assist during a tech support scam. The rogue clients then spawned wscript.exe to run four scripts, 1.vbs through 4.vbs, from the ScreenConnect temp folder. Persistence came from a WindowsServiceHost Run key pointing at WindowsServiceHost.vbs in the user's AppData.

The part that matters for this CVE: Huntress found modified ScreenConnect clients that automatically transferred and executed the same four scripts on newly connected ScreenConnect endpoints. It described the result as worm-like spread. On 3 September ConnectWise published an advisory about "file transfer behavior" and told partners to disable the file transfer permission. The CVE and patch followed on 8 September, and Huntress updated its post to point to them.

How to check if you're exposed

1. Server version. In the ScreenConnect web UI, open Administration, then Overview. Anything below 26.6.5 is vulnerable. The same page shows your "Latest Eligible Version" for licensing.
2. Client versions. Pull the installed ScreenConnect client version from your software inventory or EDR across all endpoints. On a Windows host:

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*",
  "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object DisplayName -like "ScreenConnect Client*" |
  Select-Object DisplayName, DisplayVersion

Huntress's incidents all involved rogue clients installed through social engineering, so any ScreenConnect client your team did not deploy is worth investigating on its own.

3. Audit log. Huntress says RunFiles or RanFiles entries in the ScreenConnect audit log that show the suspect scripts executed from Process: Guest should be treated as suspicious immediately.
4. Process and registry hunt. Search EDR telemetry for ScreenConnect.WindowsClient.exe spawning wscript.exe, and for a WindowsServiceHost value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run:

Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run" |
  Select-Object WindowsServiceHost

What to do now

1. Upgrade on-premises servers to 26.6.5 or later. If you are below 25.4, plan the intermediate upgrade today.
2. Reinstall host clients and update access agents on every managed machine, cloud or on-premises. This is the step most likely to be skipped.
3. Until clients are updated, apply ConnectWise's mitigation: in Administration, Security, Roles, edit each role and deselect the TransferFiles permission for every session group. Older versions call it TransferFilesInSession.
4. After patching, ConnectWise recommends reviewing users with access, removing any you don't recognize, checking roles and permissions, changing passwords and enabling MFA.
5. Hunt for the Huntress indicators above. If you find them, isolate the host and follow ConnectWise's guidance not to bring compromised servers back online until they are rebuilt and patched.

Why it matters

Remote support tools are trusted by design. Security teams allow them through firewalls and EDR, and users expect to see them. A flaw that removes the host confirmation step turns that trust into a delivery channel, and Huntress's findings show attackers using exactly that channel to spread scripts from one connected endpoint to the next.

The fix also shows a common gap in patch tracking. Teams record "ScreenConnect server upgraded" and close the ticket. For a client-side bug, the vulnerable code is on hundreds or thousands of endpoints, and some of those clients may not even belong to your instance.

Try it yourself

Export the list of every remote access tool installed across your endpoints, including ScreenConnect, Quick Assist, UltraViewer and anything else your EDR reports. Mark which ones your IT team actually uses and which server each client points to. Every unexplained client is a finding. To see how third party software risk can be tracked over time, try this demo:

Click through it at your own pace, or open it full screen.

Quick check

Sources

• ConnectWise: ScreenConnect 26.6.5 Security Patch bulletin (8 September 2026)
• ConnectWise Disclosures: CVE-2026-84869
• Huntress: Rogue ScreenConnect installations across unrelated hosts suggest worm-like activity
• CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog (11 September 2026)
• CISA Known Exploited Vulnerabilities Catalog
• NVD: CVE-2026-84869