CVE-2026-84869: ScreenConnect Client RCE Vulnerability

CVE-2026-84869 Overview

CVE-2026-84869 affects the ConnectWise ScreenConnect client. A flaw in the client allows files to be transferred and executed through an active remote session without authorization or Host confirmation under certain conditions. ScreenConnect servers themselves are not impacted by this vulnerability. The issue maps to [CWE-269] Improper Privilege Management and enables an attacker with a foothold in an active session to push and run arbitrary binaries on the target endpoint. Given ScreenConnect's role in remote support and managed service provider (MSP) environments, exploitation provides direct code execution on downstream customer endpoints.

Critical Impact

Attackers with access to an active ScreenConnect session can transfer and execute arbitrary files on the Host machine, bypassing the confirmation prompts that normally gate file delivery and execution.

Affected Products

• ConnectWise ScreenConnect client (remote support and access agent)
• Endpoints running the ScreenConnect client during active remote sessions
• MSP-managed environments deploying the ScreenConnect client at scale

Discovery Timeline

• 2026-09-08 - ConnectWise publishes security bulletin for ScreenConnect
• 2026-09-08 - CVE-2026-84869 published to NVD
• 2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-84869

Vulnerability Analysis

The vulnerability resides in the ScreenConnect client's session-side file transfer and execution logic. Under normal operation, files delivered through a remote support session require Host-side confirmation before they are written or executed. This authorization step exists to prevent a compromised or malicious remote operator from silently deploying tooling on the endpoint.

Under specific conditions, the client fails to enforce that confirmation. An operator who already has an active session to a target can push a file and trigger execution without the Host approving the action. The result is arbitrary code execution in the context of the ScreenConnect client process on the Host endpoint.

Because ScreenConnect is commonly deployed by MSPs across large customer estates, a single compromised technician account or session token can be leveraged to fan out to many downstream endpoints. This mirrors the impact pattern of prior ConnectWise incidents where remote management tooling was used as a distribution channel for ransomware and post-exploitation frameworks.

Root Cause

The root cause is improper privilege management [CWE-269] in the client's session handler. The code path that transfers and launches files does not consistently invoke the Host confirmation gate, allowing the session operator's implicit privileges to extend into unattended file execution. See the GitHub CVE-2026-84869 Disclosure for advisory details.

Attack Vector

An attacker requires an active ScreenConnect session against the target. This typically means access to an authenticated technician account, a hijacked session, or compromise of the ScreenConnect management console. From that position, the attacker delivers a payload through the session channel and invokes execution. No Host user interaction is required, and no additional prompts alert the endpoint user that a file has been written and run.

Refer to the ConnectWise Security Bulletin 2026-09-08 for vendor-supplied technical details.

Detection Methods for CVE-2026-84869

Indicators of Compromise

• Unexpected child processes spawned by the ScreenConnect client binary (for example, ScreenConnect.ClientService.exe or ScreenConnect.WindowsClient.exe) launching scripting interpreters, LOLBins, or unsigned executables.
• Files written to ScreenConnect working directories or %TEMP% immediately followed by process execution without a corresponding Host confirmation event.
• Outbound session traffic to unfamiliar ScreenConnect relay hosts or newly registered instances outside the sanctioned MSP tenant.

Detection Strategies

• Baseline the normal parent-child process tree for the ScreenConnect client and alert on deviations, especially execution of cmd.exe, powershell.exe, wscript.exe, rundll32.exe, or mshta.exe.
• Correlate file-write events in ScreenConnect directories with subsequent process creation events sharing the same file hash within a short time window.
• Review ScreenConnect audit logs for file transfer events that lack a corresponding Host acknowledgement.

Monitoring Recommendations

• Forward ScreenConnect client and server logs to a centralized logging or SIEM platform and retain them long enough to investigate technician account misuse.
• Monitor technician account activity for anomalous session times, unusual endpoint targeting, or bulk file transfer patterns.
• Alert on new ScreenConnect installations or client version rollbacks on managed endpoints.

How to Mitigate CVE-2026-84869

Immediate Actions Required

• Apply the fixed ScreenConnect client version referenced in the ConnectWise Trust Advisories page as soon as it is available for your deployment channel.
• Rotate ScreenConnect technician credentials and invalidate active sessions to force re-authentication after patching.
• Enforce multi-factor authentication (MFA) on all ScreenConnect technician and administrator accounts.
• Audit recent session activity for unauthorized file transfers or executions on Host endpoints.

Patch Information

ConnectWise addresses the flaw in updated ScreenConnect client builds referenced in the ConnectWise Security Bulletin 2026-09-08. Cloud-hosted ScreenConnect instances are typically updated by ConnectWise, but customers must still ensure that deployed clients on managed endpoints receive the corresponding client-side update. On-premises operators must upgrade both server and client components.

Workarounds

• Restrict which technicians can initiate file transfer and execution actions through ScreenConnect role-based access controls until patching is complete.
• Limit ScreenConnect access to trusted source IP ranges through network segmentation or a jump host.
• Where feasible, temporarily disable unattended access on high-value endpoints and require Host-initiated session approval.

# Configuration example: identify running ScreenConnect client versions across Windows endpoints
Get-CimInstance -ClassName Win32_Service -Filter "Name LIKE 'ScreenConnect%'" |
  Select-Object Name, PathName, State, StartMode

# Inspect installed client version from the binary
Get-Item "C:\Program Files (x86)\ScreenConnect Client*\ScreenConnect.ClientService.exe" |
  ForEach-Object { $_.VersionInfo | Select-Object FileName, ProductVersion, FileVersion }