CVE-2026-84869: ConnectWise ScreenConnect File-Transfer Bypass

CVE-2026-84869 is a missing-authorization and improper-privilege-management condition in the ConnectWise ScreenConnect client that lets files be transferred to and executed on a Host machine during an active remote session without authorization or Host confirmation, and it was added to CISA's KEV catalog days after the fix shipped because it was already being exploited to spread malware across managed device fleets.

CVE-2026-84869 is a missing-authorization (CWE-862) and improper-privilege-management (CWE-269) condition in the ConnectWise ScreenConnect remote-support client. NVD's description states "a condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances"; ScreenConnect servers themselves are not affected, only the client component (NVD).

NVD lists this CVE as fully analyzed (status "Analyzed") with a CVSS v3.1 base score of 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — network-reachable within an active session, low attack complexity, only low privileges needed, no user interaction, with a scope change and high impact to confidentiality, integrity and availability (NVD).

CISA added CVE-2026-84869 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-09-11, with a required-action due date of 2026-09-14; the catalog lists known ransomware campaign use as "Unknown" (CISA KEV).

ConnectWise's own disclosure confirms all ScreenConnect versions before 26.6.5.9742 are affected, fixed in version 26.6.5 (shipped 2026-09-08); cloud-hosted instances were patched automatically, but on-premise installs must upgrade manually and must already be on release 25.4 or later to go directly to 26.6.5. As a temporary, partial mitigation short of patching, ConnectWise documents removing the "TransferFiles" permission from affected session-group roles (Administration > Security > Roles), explicitly noting this reduces exposure but does not replace the security update (ConnectWise Disclosure CVE-2026-84869).

As of 2026-10-26, FIRST scores the probability of exploitation at 0.0092 (60.2th percentile) — modest for a KEV-listed flaw, consistent with most internet-facing ScreenConnect installs having already applied the September patch by the time this score was measured (FIRST EPSS).

Because this is a client-side flaw that enabled file transfer and execution without host confirmation during live support sessions, any ScreenConnect deployment should confirm clients and access agents are on 26.6.5 or later, not just the server, and review session logs for unexpected file-transfer activity predating the patch.

• ScreenConnect client allows files to be transferred and executed through an active remote session without authorization or Host confirmation (CWE-862/CWE-269); servers are not affected. — NVD
• CVSS v3.1 base score is 9.9 (critical), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, NVD status Analyzed. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2026-09-11, due date 2026-09-14, ransomware use listed as Unknown. — CISA KEV
• Affected: ScreenConnect client before 26.6.5.9742, fixed in 26.6.5 (2026-09-08); on-premise licenses must be on 25.4+ to upgrade directly; temporary mitigation is removing the TransferFiles permission, not a substitute for patching. — ConnectWise Disclosure CVE-2026-84869
• EPSS score is 0.0092 (60.2th percentile) as of 2026-10-26. — FIRST EPSS