CVE-2026-84869

Analyzed Analyzed - Analysis Complete

ScreenConnect Client Unauthorized File Transfer and Execution

Publication date: 2026-09-08

Last updated on: 2026-09-12

Assigner: ConnectWise

Description

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-12

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-84869

Affected Vendors & Products

Vendor	Product	Version / Range
connectwise	screenconnect	to 26.6.5.9742 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-269	The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

Executive Summary

CVE-2026-84869 is a critical vulnerability in the ScreenConnect client that allows unauthorized file transfers and execution during active remote sessions without proper authorization or host confirmation. This flaw exists in client-side file-transfer handling in versions prior to 26.6.5. ScreenConnect servers are not affected.

Detection Guidance

Detection involves checking ScreenConnect client versions and reviewing file-transfer permissions. For on-premises systems, verify if versions are below 26.6.5. Check the Administration > Security > Roles section for any enabled TransferFiles permissions.

Impact Analysis

An attacker could exploit this to transfer and execute malicious files on your system during a remote session. This could lead to unauthorized access, data theft, malware installation, or system compromise. The high CVSS score of 9.9 indicates significant risk of exploitation.

Mitigation Strategies

Disable TransferFiles permission in roles under Administration > Security > Roles until updated.
Update ScreenConnect clients to version 26.6.5 or later.
For on-premises systems, manually upgrade to version 26.6.5 or later.
Review and remove unrecognized users, reset passwords, and enable multi-factor authentication (MFA).

Hi! I’m here to help you understand CVE-2026-84869. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70