ScreenConnect client transfers and executes files in an active session without authorization (CVE-2026-84869)
ConnectWise shipped the 26.6.5 fix on 2026-09-08 and Huntress reports rogue ScreenConnect installations spreading across unrelated hosts, so unpatched clients can have files pushed and run on them during a session with no host prompt.
A missing-authorization condition in the ScreenConnect client lets file-transfer and file-execution actions be processed through an active remote session without Host confirmation, giving code execution on the endpoint. ScreenConnect servers themselves are not affected, but every client and access agent built from a pre-26.6.5 release is.
Affected: ConnectWise ScreenConnect (CW Remote Access) Support and Access sessions, all versions prior to 26.6.5 — cloud and on-premise
How to Test
Compare your ScreenConnect version against 26.6.5 and confirm that host clients and access agents have been reinstalled/updated after the upgrade; in Administration > Security > Roles, check which session groups still grant TransferFiles (TransferFIlesInSession on legacy versions). Hunt for unexpected or duplicate ScreenConnect client installations on unrelated hosts and for files written and executed during recent remote sessions, per the Huntress write-up.
How to Patch
On-premise: upgrade to ScreenConnect 26.6.5 from the vendor download page (a current maintenance licence is required). Cloud: no server action is needed, but reinstall host clients and update access agents so endpoints run the patched client. As an interim measure that needs no upgrade, edit each role under Administration > Security > Roles and deselect the TransferFiles permission (TransferFIlesInSession on legacy versions) for every session group that has it.