# ScreenConnect client runs transferred files without host confirmation

Source: https://startwithidentity.com/cves/cve-2026-84869/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## What broke

ConnectWise published a bulletin on September 8, 2026 for a flaw in the ScreenConnect client, not the server. In Support and Access sessions on versions before 26.6.5, files could be transferred to the host and run "without authorization or Host confirmation in certain circumstances," including through elevated execution actions. ConnectWise maps it to CWE-269 (improper privilege management) and CWE-862 (missing authorization) and scores it CVSS 3.1 9.9. The vector needs a low-privilege account (PR:L) and no user interaction, and scope is changed. ConnectWise rated it priority 1 and withheld more technical detail.

Cloud-hosted servers were already updated to 26.6.5. On-premises servers need the upgrade, which requires 25.4 or later and a license under maintenance. CISA added it to KEV on September 11, 2026, three days after the bulletin.

## Why it matters

In a support tool, the host confirmation prompt and the per-role TransferFiles permission decide what a technician can do to the person on the other end. If a session can push and run a file without either check, any account that can open a session gets code execution on the endpoint, possibly elevated. A compromised or low-privilege technician account then becomes a way to run code on customer machines. It is the same platform where [CVE-2024-1709](https://startwithidentity.com/cves/cve-2024-1709/) let an unauthenticated caller rerun setup and create an administrator in 2024.

## What to do

- Upgrade on-premises servers to ScreenConnect 26.6.5 or later.
- After upgrading, reinstall host clients and update access agents. ConnectWise gives this step to cloud customers too, since the flaw sits in the client.
- Until you can patch, go to Administration, Security, Roles and clear the TransferFiles permission on each role's session groups. ConnectWise says this is not a substitute for the update.

## After you patch

- Review users, roles and permissions. Remove accounts you do not recognize, change passwords and turn on [MFA](https://startwithidentity.com/glossary/mfa/) for every technician, as the bulletin advises.
- Check session logs for file transfers and command runs you cannot tie to a support ticket.
- Apply [least privilege](https://startwithidentity.com/glossary/least-privilege/) to roles so file transfer and elevated execution go only to technicians who need them.

## Sources

- [NVD: CVE-2026-84869](https://nvd.nist.gov/vuln/detail/cve-2026-84869)
- [ConnectWise: ScreenConnect 26.6.5 security patch bulletin (September 8, 2026)](https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin)
- [ConnectWise advisory disclosure: CVE-2026-84869](https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869)
- [CISA Known Exploited Vulnerabilities catalog, added September 11, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869)