CVE-2026-84869: ConnectWise ScreenConnect Flaw Enables Unauthorized File Transfer and Execution

Background

ConnectWise ScreenConnect is a widely deployed remote access and remote support tool used by MSPs, IT help desks, and internal support teams to connect to and control end-user devices. Its core functionality — establishing a remote session between a technician and a host machine, including file transfer and remote command execution — is precisely what makes compromises of ScreenConnect so consequential: the tool is designed to be trusted with full device control, and any flaw that weakens the authorization model around that control directly threatens every endpoint ScreenConnect touches.

ScreenConnect has a well-documented history as a high-value target; prior CVEs in the product (including CVE-2024-1708 and CVE-2024-1709) were exploited at scale, including by ransomware affiliates, to gain initial access through compromised or abused ScreenConnect instances. CVE-2026-84869 continues that pattern: a flaw involving both improper privilege management and missing authorization that allows file transfer and execution through an active remote session without authorization or host confirmation.

Technical Mechanism

CISA’s KEV entry associates CVE-2026-84869 with two weaknesses: CWE-269 (Improper Privilege Management) and CWE-862 (Missing Authorization). Normally, when a ScreenConnect technician session performs sensitive actions like transferring a file to the host machine or executing a command on it, the host-side user is expected to see and approve a confirmation prompt — a deliberate control designed to prevent a compromised or malicious session from silently taking action on the endpoint.

The vulnerability chain works as follows:

1. Missing Authorization (CWE-862): One or more ScreenConnect operations related to file transfer or remote execution lack a proper authorization check that should gate the action behind explicit host confirmation.
2. Improper Privilege Management (CWE-269): The session-level privilege model fails to correctly scope what an active remote session is permitted to do without that confirmation step, meaning the session carries more effective privilege than the UI/workflow implies it should have.
3. Combined, an attacker who has established — or hijacked — an active remote session can transfer arbitrary files to the host and execute them, or run other privileged actions, without the host confirmation dialog that administrators and end users rely on as the last line of defense against unauthorized remote actions.

Because the “host confirmation” step is specifically designed to be the human-in-the-loop safeguard against exactly this kind of abuse, bypassing it converts an otherwise-contained remote support session into a vector for silent, unauthorized code execution on the managed endpoint.

Real-World Exploitation Evidence

CVE-2026-84869 is listed in CISA’s KEV catalog, added on 2026-09-11, confirming CISA has evidence of active real-world exploitation. The knownRansomwareCampaignUse field is listed as “Unknown,” meaning CISA has not confirmed this specific CVE is tied to a named ransomware campaign as of KEV addition. Given ScreenConnect’s exploitation history as a ransomware access vector in prior incidents, “Unknown” should be read as “not yet confirmed,” not as a reason to deprioritize remediation.

No specific threat actor or campaign name has been publicly attributed to exploitation of CVE-2026-84869 in the data available to us. The KEV listing confirms exploitation occurred in the wild; attribution detail is not yet public. ConnectWise’s own security bulletin (dated 2026-09-08) is the authoritative source for any further detail on observed exploitation.

Impact Assessment

Because ScreenConnect sessions are specifically trusted with device control, this vulnerability’s impact centers on what an attacker can do once file transfer and execution are no longer gated by host confirmation:

• Integrity: An attacker can push and execute arbitrary files on the host machine — malware, ransomware payloads, or further tooling — without any visible prompt the end user or administrator could use to detect or block the action.
• Confidentiality: Remote session access combined with unauthorized file transfer capability allows exfiltration of data from the managed endpoint.
• Availability: Arbitrary code execution on the host can be used to disable security tooling, destroy data, or otherwise disrupt endpoint operations.

Sector-specific risk: ScreenConnect’s primary deployment base — MSPs and internal IT help desks — means a single abused or compromised instance can reach every endpoint under that technician’s or MSP’s remote-support purview. This mirrors the “one-to-many” risk profile seen in the 2024 ScreenConnect incidents, where a compromised ScreenConnect server was used to push ransomware across numerous downstream client environments simultaneously.

Affected Versions

ConnectWise’s security bulletin is the authoritative source for exact affected version ranges; the KEV data provided here does not specify version boundaries. Organizations should consult the vendor bulletin directly:

Remediation Steps

CISA’s required action directs applying vendor mitigations consistent with BOD 26-04 risk-based guidance and Forensics Triage Requirements, and discontinuing use of the product where mitigation is unavailable.

1. Apply the ConnectWise security update referenced in the 2026-09-08 ScreenConnect security bulletin to all on-premise ScreenConnect servers immediately. Cloud-hosted ScreenConnect instances should confirm with ConnectWise that the fix has been applied server-side.

# Example: check installed ScreenConnect server version via its admin console/API
# (exact command depends on deployment type — on-prem vs. cloud)
curl -s https://<your-screenconnect-host>/Api/ScreenConnect.ClientService.ashx/version

2. Audit active and recent session logs for file transfer or execution events that lack a corresponding host-confirmation record, which may indicate exploitation of this flaw.
3. Restrict who can initiate remote sessions and enforce multi-factor authentication on all technician accounts to reduce the chance of session hijacking being used as the entry point for this flaw.
4. Follow Forensics Triage Requirements on any ScreenConnect server that was internet-reachable and unpatched during the exposure window, given confirmed active exploitation.
5. Review endpoint security tooling on all machines managed via affected ScreenConnect instances for signs of unauthorized file execution during the exposure window.

Detection Guidance

• Review ScreenConnect server-side session logs for file transfer and remote-execution events that do not have a matching host-confirmation acknowledgment in the log trail.
• Monitor endpoint EDR/AV telemetry on ScreenConnect-managed hosts for file writes or process launches originating from the ScreenConnect client process shortly after a remote session connects, particularly files that do not match expected support workflows.
• Flag ScreenConnect sessions that perform file transfer or execution actions in rapid succession immediately after connection, which can be consistent with automated exploitation rather than human-driven support activity.
• Exact detection signatures should be sourced from ConnectWise’s security bulletin updates and your EDR/SIEM vendor’s threat feeds as further detail becomes public.

Timeline

References

• ConnectWise Security Bulletin — 2026-09-08 ScreenConnect Bulletin
• CISA BOD 26-04 — Prioritizing Security Updates Based on Risk
• CISA — BOD 26-04 Implementation Guidance: Forensics Triage Requirements
• NVD — CVE-2026-84869