Loading vulnerability…
Authorization bypass and remote code execution in ConnectWise ScreenConnect clients
CVE-2026-84869 is a missing-authorization and improper-privilege-management vulnerability affecting ConnectWise ScreenConnect clients before version 26.6.5. In certain circumstances, a low-privileged authenticated user with access to an active remote session can bypass file-transfer and execution controls, transferring and executing arbitrary files on the remote endpoint without host authorization or confirmation. The flaw resides in client and session handling; ScreenConnect servers are not directly affected. It has a CVSS v3.1 score of 9.9 and is actively exploited. ScreenConnect 26.6.5 strengthens authorization handling for file-transfer and file-execution actions.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation permits unauthorized code execution on endpoints managed through ScreenConnect, potentially compromising confidentiality, integrity, and availability. Attackers can deploy malicious payloads, access confidential data, steal credentials, establish persistence, and facilitate lateral movement. Execution can include elevated-privilege actions, although the precise execution identity and privilege level depend on the session context. Observed attacks delivered VBScript payloads intended to establish persistence and propagate to other ScreenConnect clients. Confirmed ransomware use is not established.
If you can’t patch tonight, do this now.
Until patching is complete, remove the TransferFiles permission, or legacy TransferFilesInSession permission, from all applicable roles and session groups. Restrict session access to trusted operators, terminate unnecessary sessions, limit web-interface and relay access to trusted networks, and segregate ScreenConnect from sensitive network segments. Require host consent where available, restrict elevated session modes, and use endpoint application controls to constrain payload execution and child processes. Monitor unauthorized transfers and unexpected execution. These measures reduce risk but do not eliminate the vulnerability; discontinue affected-client use where adequate mitigation is unavailable.
Patch, then assume compromise.
Upgrade affected ScreenConnect clients and deployments to version 26.6.5 or a later vendor-fixed release. On-premises installations require a manual upgrade; installations must be running version 25.4 or later before upgrading to 26.6.5. Reinstall or refresh host clients and update access agents after the deployment upgrade, verifying that endpoints actually run fixed versions. Cloud deployments are updated automatically, but endpoint client and agent versions should still be verified. Review accounts, session history, file-transfer records, and endpoint execution activity for compromise; reset affected credentials and invalidate sessions or tokens when suspicious activity is identified.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
79 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.