Critical ScreenConnect Flaw CVE-2026-84869 Allows Unauthorized File Execution

ScreenConnect instances face a critical threat following the disclosure of CVE-2026-84869, a severe improper privilege management and missing authorization vulnerability in ConnectWise ScreenConnect. The flaw allows authenticated, low-privilege operators to execute arbitrary file transfers and initiate code execution across active remote sessions without host confirmation or administrative approval. Because remote monitoring and management (RMM) platforms sit at the root of trust for Managed Service Providers (MSPs) and enterprise IT departments, an authorization failure of this magnitude effectively transforms a compromised low-level account into a network-wide payload delivery mechanism.

Anatomy of the Authorization Bypass

CVE-2026-84869 combines improper privilege management (CWE-269) and missing authorization checks (CWE-862). Under normal operational parameters, transferring files to a managed endpoint and initiating background execution requires explicit session privileges and host-side visibility.

The flaw stems from incomplete permission enforcement during remote session command processing. An attacker holding minimal session privileges (PR:L) can craft requests that bypass the authorization checks governing remote file delivery and execution commands. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, score 9.9) highlights a scope change (S:C), reflecting how an exploit originating within a restricted ScreenConnect user context directly compromises the underlying guest operating systems running the ScreenConnect client agent.

While the current EPSS score stands at 0.38% (31.6th percentile), security teams should not let a low initial probability value delay patching. RMM tools are primary targets for access brokers and threat actors; once exploit mechanics become widely understood, the window between low EPSS scoring and active, automated exploitation opens rapidly.

MSP Exposure and Operational Impact

RMM platforms represent high-yield targets because a single compromised management server provides administrative access across hundreds of disparate client networks. If an adversary gains access to a low-privileged technician account or compromised session credential, CVE-2026-84869 permits silent staging of malicious tools—such as secondary command-and-control beacons or ransomware loaders—directly onto downstream endpoints.

Because the vulnerability requires zero user interaction (UI:N) and suppresses host confirmation prompts, end users will see no visual indicators or consent pop-ups while file transfers and commands run in the background. Traditional user-reporting mechanisms will fail to catch active exploitation in real time.

Remediation and Detection Requirements

ConnectWise resolved this issue in ScreenConnect version 26.6.5.9742. Organizations operating self-hosted or cloud-managed instances must execute the following remediation actions:

• Apply Firmware/Software Patches: Update self-hosted ScreenConnect installations to version 26.6.5.9742 or later immediately. Confirm that cloud-managed instances have been updated by the vendor.
• Adhere to Mandated Deadlines: Federal organizations and compliance-bound entities must complete remediation by September 14, 2026, adhering to CISA BOD 26-04 guidance.
• Audit Session Logs: Inspect ScreenConnect audit logs and session events for abnormal background command execution or unexpected FileTransfer events initiated by lower-tiered user accounts prior to patch deployment.

If an immediate patch cannot be applied to an on-premises instance, restrict internet accessibility to the ScreenConnect management interface until the update to version 26.6.5.9742 can be completed.