ConnectWise Fixes a 9.9-Rated Flaw in ScreenConnect's File Transfer
Security / news
ConnectWise Fixes a 9.9-Rated Flaw in ScreenConnect's File Transfer
The bug let anyone already inside a remote session push and run files on the host machine without a click of confirmation, and CISA added it to its exploited-vulnerabilities catalog three days after the patch shipped.
ConnectWise patched a ScreenConnect flaw rated 9.9 out of 10 on the CVSS severity scale, letting anyone already inside an active remote-support session transfer and run files on the host machine with no confirmation from whoever owns it, the company said in a security bulletin dated Sept. 8.
The Cybersecurity and Infrastructure Security Agency added the bug, tracked as CVE-2026-84869, to its Known Exploited Vulnerabilities catalog Sept. 11, three days after the fix shipped.
A guest session, no host click required
The flaw sits in the ScreenConnect client rather than the server, according to ConnectWise; the company says its own server component is unaffected. Its CVSS vector, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, requires an attacker to already hold low privileges inside a session rather than reach the flaw over the open network with no access at all. That precondition matters: the bug does not get an attacker into a ScreenConnect session by itself. A technician still has to start one, or an attacker needs a credential that lets them join one, before the file-transfer flaw becomes useful.
Once inside, ConnectWise said the missing authorization and privilege checks let that session guest push files to the host and execute them without the host user approving the transfer, the confirmation step ScreenConnect normally requires. The vector's scope-changed flag, S:C, marks that the impact runs past the ScreenConnect client itself to whatever else the host machine can reach, which for a technician's own workstation is typically every endpoint their account is trusted to manage.
ScreenConnect exists so a support technician can take over a customer's machine for a few minutes without an ongoing VPN link between the two networks. That convenience is also the risk here: a session already carries permission to move files and run commands by design, so a gap in the guardrails around it turns a support tool into a foothold rather than a bug that first has to get an attacker onto the network at all.
Five days from warning to patch
ConnectWise first warned customers Sept. 3 and shipped the fix, ScreenConnect 26.6.5, on Sept. 8, according to Computerworld. Before the client update was available, the company's interim guidance was to remove the "TransferFiles" permission from any user with an open session. Cloud-hosted ScreenConnect instances were updated automatically; on-premises partners had to apply the upgrade themselves.
ConnectWise's remote-access tools have drawn scrutiny before. According to CSO Online, the company disclosed a nation-state intrusion in May 2025 and separately patched a ScreenConnect flaw under active exploitation in 2024. Remote-support software is a target that pays off for an intruder once: a single compromised session can reach every endpoint the technician's account is trusted to manage, which is also why CISA's catalog gained an authentication-bypass bug in Cisco's Firewall Management Center the same week, and why N-able's N-central drew its own KEV entry days earlier.
| Detail | Value |
|---|---|
| CVSS 3.1 | 9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| Affected | ScreenConnect client before 26.6.5 |
| Fixed | ScreenConnect 26.6.5 |
| Customers warned | Sept. 3, 2026 |
| Patch shipped | Sept. 8, 2026 |
| Added to CISA KEV | Sept. 11, 2026 |
ConnectWise has not said whether it has evidence of the flaw being exploited before CISA's listing, only that the catalog addition reflects the agency's own confirmation of active exploitation. Partners running on-premises ScreenConnect below 26.6.5 remain exposed until they upgrade.
Sources
More in Security
- 01Cisco and Acronis Share a CISA Deadline, Not a Severity ScoreOne flaw needs no password and no user interaction, the other needs an attacker already logged in, and CISA gave federal agencies the same three days to fix both.
- 02Bransys ELD App Shipped With Hardcoded Login CredentialsCISA disclosed three flaws Sept. 17 in the trucking compliance app, including a hardcoded password a researcher says exposed live location and engine data from every connected truck on a subset of fleets.
- 03MikroTik Patches RouterOS Flaws Attackers Exploited FirstPoland's national CERT says attackers began exploiting the chained flaws on Sept. 2, a day before MikroTik shipped a fix, and more than 122,500 routers were still reachable a week later.
- 04Attackers Exploit a JFrog Artifactory Bug in Four DayswatchTowr says attackers began minting administrator tokens by abusing a default empty join key, CVE-2026-82329, within days of JFrog's own patch shipping.