ConnectWise Fixes a 9.9-Rated Flaw in ScreenConnect's File Transfer

ConnectWise patched a ScreenConnect flaw rated 9.9 out of 10 on the CVSS severity scale, letting anyone already inside an active remote-support session transfer and run files on the host machine with no confirmation from whoever owns it, the company said in a security bulletin dated Sept. 8.

The Cybersecurity and Infrastructure Security Agency added the bug, tracked as CVE-2026-84869, to its Known Exploited Vulnerabilities catalog Sept. 11, three days after the fix shipped.

A guest session, no host click required

The flaw sits in the ScreenConnect client rather than the server, according to ConnectWise; the company says its own server component is unaffected. Its CVSS vector, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, requires an attacker to already hold low privileges inside a session rather than reach the flaw over the open network with no access at all. That precondition matters: the bug does not get an attacker into a ScreenConnect session by itself. A technician still has to start one, or an attacker needs a credential that lets them join one, before the file-transfer flaw becomes useful.

Once inside, ConnectWise said the missing authorization and privilege checks let that session guest push files to the host and execute them without the host user approving the transfer, the confirmation step ScreenConnect normally requires. The vector's scope-changed flag, S:C, marks that the impact runs past the ScreenConnect client itself to whatever else the host machine can reach, which for a technician's own workstation is typically every endpoint their account is trusted to manage.

ScreenConnect exists so a support technician can take over a customer's machine for a few minutes without an ongoing VPN link between the two networks. That convenience is also the risk here: a session already carries permission to move files and run commands by design, so a gap in the guardrails around it turns a support tool into a foothold rather than a bug that first has to get an attacker onto the network at all.

Five days from warning to patch

ConnectWise first warned customers Sept. 3 and shipped the fix, ScreenConnect 26.6.5, on Sept. 8, according to Computerworld. Before the client update was available, the company's interim guidance was to remove the "TransferFiles" permission from any user with an open session. Cloud-hosted ScreenConnect instances were updated automatically; on-premises partners had to apply the upgrade themselves.

ConnectWise's remote-access tools have drawn scrutiny before. According to CSO Online, the company disclosed a nation-state intrusion in May 2025 and separately patched a ScreenConnect flaw under active exploitation in 2024. Remote-support software is a target that pays off for an intruder once: a single compromised session can reach every endpoint the technician's account is trusted to manage, which is also why CISA's catalog gained an authentication-bypass bug in Cisco's Firewall Management Center the same week, and why N-able's N-central drew its own KEV entry days earlier.

Detail	Value
CVSS 3.1	9.9, AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected	ScreenConnect client before 26.6.5
Fixed	ScreenConnect 26.6.5
Customers warned	Sept. 3, 2026
Patch shipped	Sept. 8, 2026
Added to CISA KEV	Sept. 11, 2026

ConnectWise has not said whether it has evidence of the flaw being exploited before CISA's listing, only that the catalog addition reflects the agency's own confirmation of active exploitation. Partners running on-premises ScreenConnect below 26.6.5 remain exposed until they upgrade.