Loading story…
ConnectWise disclosed an unnumbered security issue affecting file-transfer behavior in ScreenConnect Remote Access Support and Access sessions. The issue affects both cloud-hosted and self-hosted ScreenConnect deployments; the company had not released exploit details, affected-version information, or evidence of active exploitation.
Until cloud updates and a permanent patched release are available, ConnectWise advised administrators to remove technician file-transfer privileges from applicable roles, including TransferFiles and the legacy TransferFilesInSession permission. Organizations should review privileged ScreenConnect accounts and monitor for unusual file-transfer activity or changes to role permissions; a CVE is expected after the cloud-environment rollout is complete.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
ConnectWise advisory and bulletin references identified CVE-2026-84869 as an authorization flaw in the ScreenConnect client that can permit unauthorized file transfer and execution through an active remote session in certain circumstances. The CVE states that ScreenConnect servers are not affected and assigns a CVSS 3.1 score vector indicating high confidentiality, integrity, and availability impact.
ConnectWise published an advisory for an unnumbered security issue in ScreenConnect Remote Access file-transfer behavior affecting Support and Access sessions in both cloud-hosted and self-hosted deployments. It advised administrators to immediately remove TransferFiles or legacy TransferFilesInSession permissions while it completes cloud updates and develops a permanent fix.
ConnectWise stated that it remediated ScreenConnect cloud servers and that ScreenConnect 26.6.5 and later remediate CVE-2026-84869 for affected host clients and access agents. It advised customers to upgrade, including through Automate Product Updates for integrated deployments; removing TransferFiles remains a temporary mitigation.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourceconnectwise.com
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ConnectWise released ScreenConnect version **26.6.5** to address **CVE-2026-84869**, a critical authentication failure in its remote-access product. The Canadian Centre for Cyber Security reported that open-source reporting showed active exploitation of the flaw in the wild as of September 8, while CSO Online reported that the issue had remained unresolved for five days before the patch was issued. Organizations running ScreenConnect versions earlier than 26.6.5 should promptly apply the vendor's security update and review ConnectWise security bulletins for associated guidance. Because ScreenConnect provides remote administrative access, defenders should also investigate for unauthorized access or anomalous activity on exposed ScreenConnect infrastructure, particularly where patching was delayed.
Sep 17, 2026
**ConnectWise ScreenConnect** disclosed a critical vulnerability, **CVE-2026-3564** (**CVSS 9.0**), affecting versions prior to **26.1**. The flaw stems from ScreenConnect storing unique per-instance machine keys and related cryptographic material in plaintext server configuration files, creating a path for attackers under certain conditions to extract those keys and abuse them for unauthorized access. The issue is classified as **CWE-347: Improper Verification of Cryptographic Signature**, and successful exploitation can undermine confidentiality, integrity, and availability in environments that rely on ScreenConnect for remote access. With the exposed machine keys, an attacker could forge or manipulate session authentication tokens, hijack legitimate sessions, and elevate access without user interaction. ConnectWise rated the issue as high priority, and the **Centre for Cybersecurity Belgium** urged organizations to patch immediately, monitor for suspicious activity, and treat updates as protection against future exploitation rather than proof that no prior compromise occurred. The vendor states the issue is fixed in **version 26.1**, making rapid remediation and post-patch review important for on-premises deployments.
Jul 23, 2026
ConnectWise released a security update for ScreenConnect to address a critical vulnerability, tracked as CVE-2025-14265, which affects the server component of the remote access platform. The flaw, caused by improper code integrity validation during extension installations (CWE-494), could allow attackers with authorized or administrative access to expose sensitive configuration data and install untrusted extensions. The vulnerability carries a CVSS 3.1 base score of 9.1, highlighting its severity, though ConnectWise reports no evidence of active exploitation at this time. The issue impacts all ScreenConnect versions prior to 25.8, and the 25.8 patch enforces stricter server-side validation and integrity checks for extension installations. ConnectWise has automatically applied updates to cloud-hosted ScreenConnect instances, while on-premises users must manually upgrade to version 25.8. Partners using Automate integration are advised to update their Automate ScreenConnect Extension before upgrading ScreenConnect itself. Security advisories from both ConnectWise and the Canadian Centre for Cyber Security urge organizations to prioritize patching to prevent potential unauthorized access and maintain secure remote management environments. The vulnerability is rated as Priority 2 – Moderate, with a recommended update window of 30 days, but immediate action is encouraged due to the risk of sensitive data exposure.
Jun 29, 2026