ConnectWise ScreenConnect Critical Vulnerability

Overview

• CVE: CVE-2026-84869

• Severity: Critical, CVSS 9.9

• Vendor priority: High, Priority 1

• Advisory date: 8 September 2026

ConnectWise has released ScreenConnect 26.6.5 to address a critical vulnerability affecting the ScreenConnect client. The issue may allow files to be transferred and executed through an active remote session without authorisation or host confirmation in certain circumstances. The vendor advises treating the update as an emergency change and applying it as soon as possible.

Affected Versions

ConnectWise ScreenConnect client

• Affected: ScreenConnect versions prior to 26.6.5

• Fixed: ScreenConnect 26.6.5 or later

• Not affected: ScreenConnect servers

• Source: ConnectWise ScreenConnect 26.6.5 Security Patch

Vulnerability Breakdown

CVE-2026-84869 - Missing authorisation in file transfer and execution actions

• Severity: Critical

• CVSS: 9.9, CVSS v3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

• Description: A missing authorisation condition in the ScreenConnect client may permit files to be transferred and executed through an active remote session without authorisation or host confirmation in certain circumstances.

• Impact: An attacker with the required low privileges could compromise confidentiality, integrity and availability within the affected session context.

• Conditions: The vendor describes the issue as affecting the ScreenConnect client during an active remote session. The CVSS vector specifies low privileges required and no user interaction.

• Notes: ConnectWise states that ScreenConnect servers are not impacted. The Canadian Centre for Cyber Security reports that open-source reporting indicates exploitation in the wild.

Mitigation

1. Upgrade on-premises ScreenConnect installations to version 26.6.5 as an emergency change.

2. After upgrading, reinstall host clients and update access agents.

3. If immediate patching is not possible, navigate to Administration > Security > Roles, review each assigned session group, and remove the TransferFiles permission from every role. This is a temporary mitigation, not a replacement for patching.

4. Confirm the current version and upgrade eligibility in Administration > Overview. On-premises partners must run version 25.4 or later to upgrade to 26.6.5.

5. Review ScreenConnect users, roles and permissions, remove unrecognised accounts, change passwords and enable MFA after patching.

6. If compromise is suspected, isolate affected servers, preserve backups for analysis, and follow established incident response procedures before returning systems to service.

Summary for IT Teams

• Product: ConnectWise ScreenConnect client

• Threat level: Critical, CVSS 9.9

• Action required: Update affected on-premises installations to ScreenConnect 26.6.5 immediately. Cloud instances have already been upgraded by ConnectWise. Apply the temporary role-permission mitigation only where patching cannot occur immediately.

References

• ConnectWise ScreenConnect 26.6.5 Security Patch

• ConnectWise ScreenConnect Remote Access Guest File Transfer Advisory

• CVE Record for CVE-2026-84869

• ConnectWise Advisory Disclosure for CVE-2026-84869

• Canadian Centre for Cyber Security Advisory AV26-903

Need Help?

Secure ISS can help assess exposure, validate the upgrade path and support remediation. Contact our team on 1300 769 460 or email us to strengthen your cybersecurity posture.