CVE-2026-84869ScreenConnect client runs transferred files without host confirmation
What broke
ConnectWise published a bulletin on September 8, 2026 for a flaw in the ScreenConnect client, not the server. In Support and Access sessions on versions before 26.6.5, files could be transferred to the host and run "without authorization or Host confirmation in certain circumstances," including through elevated execution actions. ConnectWise maps it to CWE-269 (improper privilege management) and CWE-862 (missing authorization) and scores it CVSS 3.1 9.9. The vector needs a low-privilege account (PR:L) and no user interaction, and scope is changed. ConnectWise rated it priority 1 and withheld more technical detail.
Cloud-hosted servers were already updated to 26.6.5. On-premises servers need the upgrade, which requires 25.4 or later and a license under maintenance. CISA added it to KEV on September 11, 2026, three days after the bulletin.
Why it matters
In a support tool, the host confirmation prompt and the per-role TransferFiles permission decide what a technician can do to the person on the other end. If a session can push and run a file without either check, any account that can open a session gets code execution on the endpoint, possibly elevated. A compromised or low-privilege technician account then becomes a way to run code on customer machines. It is the same platform where CVE-2024-1709 let an unauthenticated caller rerun setup and create an administrator in 2024.
What to do
- Upgrade on-premises servers to ScreenConnect 26.6.5 or later.
- After upgrading, reinstall host clients and update access agents. ConnectWise gives this step to cloud customers too, since the flaw sits in the client.
- Until you can patch, go to Administration, Security, Roles and clear the TransferFiles permission on each role's session groups. ConnectWise says this is not a substitute for the update.
After you patch
- Review users, roles and permissions. Remove accounts you do not recognize, change passwords and turn on MFA for every technician, as the bulletin advises.
- Check session logs for file transfers and command runs you cannot tie to a support ticket.
- Apply least privilege to roles so file transfer and elevated execution go only to technicians who need them.
Sources
Related identity CVEs
Related on Start with Identity
- CVESimpleHelp technicians can promote themselves to server admin
Missing backend authorization checks in SimpleHelp 5.5.7 and earlier let a low-privilege technician make API keys with admin rights and take over the remote sup
- CVEBeyondTrust Remote Support pre-auth command injection, a variant of CVE-2024-12356
An unauthenticated request could run operating system commands on self-hosted BeyondTrust Remote Support and older Privileged Remote Access appliances. Scanning
- CVEAD FS elevation of privilege exploited as a zero-day
A low-privileged local user on an AD FS server could become administrator on the box that holds the federation token-signing keys. Microsoft saw exploitation be
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- BlogPEERSTITCH implant tags FortiOS VPN sessions to skip security checks
Unit 42 found an in-memory FortiOS implant that patches the IKE daemon so tagged VPN sessions bypass default security validations. Attackers reached root with C