CVE-2026-84869 ScreenConnect Client File Transfer PrivEsc Advisory

Summary of Key Information for CVE-2026-84869 Vulnerability Overview CVE ID: CVE-2026-84869 Published: September 8, 2026 CVSS 3.1 Score: 9.9 (Critical) CWE: CWE-862 (Missing Authorization), CWE-269 (Improper Privilege Management) Description: The conditional file transfer feature in the ScreenConnect client allows files to be transferred and executed via an active remote session without authorization or host confirmation. The ScreenConnect server is not affected. Scope of Impact Affected Products: ScreenConnect versions prior to 26.6.5 Fixed In: ScreenConnect 26.6.5 and later Affected Components: Client-side file transfer handling logic in "Support" and "Access" sessions within the ScreenConnect client Remediation Cloud Deployment No action required: The server in the ScreenConnect cloud environment has been updated to mitigate this issue. Client updates recommended: - Reinstall the host client: Get started - Reinstall and upgrade the access agent: Get started Local Deployment Upgrade to ScreenConnect 26.6.5 or later. For local deployments with automatic integration: As long as the automatic assurance subscription is active, the automatic partner should apply the ScreenConnect 26.6.5 update via automatic product updates. If the ScreenConnect license has expired, renew or upgrade the license before installing the latest supported version. If the update cannot be applied immediately due to maintenance windows or change freeze policies, the following temporary mitigation measures (alternative to the security patch) can be implemented: 1. Navigate to the "Administration > Security > Roles" section. 2. Edit a role, review each assigned session group, and uncheck the "TransferFiles" permission (if checked). 3. Save the changes and repeat this process for each role. References CVE Record ConnectWise Advisory Page > Note: The page does not include POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-84869 ScreenConnect Client File Transfer PrivEsc Advisory

More from this source