CVE-2026-84869

ScreenConnect is a remote support tool that lets someone view and control a computer. This vulnerability can let a bad actor, during an active session, sneak files onto the machine and run them—without the host computer properly stopping and asking for permission—similar to someone slipping a “run this” instruction into a remote help session.

This matters if your business uses ScreenConnect for remote support on customer or employee computers. The danger is highest when an attacker can participate in an active remote session (the findings describe an authenticated attacker with an active screen-sharing session) and can trigger file transfer/execution without the Host being properly confirmed. There’s no clear statement that it’s automatically reachable in the default setup; treat it as a risk only where ScreenConnect is reachable and attackers can get into an active session.

This is actively exploited in the real world and has worm-like campaigns reported, meaning attackers are using it to spread malware and gain control at scale. Because it enables remote code execution during an active session, the window to act is short: patch immediately to stop repeat compromise and propagation.

1. Confirm exposure (fast triage)

   • Identify every machine where the ScreenConnect host client/agent is installed (workstations, servers, and any devices used for remote support).
   • Check the installed ScreenConnect version and compare it to the vendor fix: fixed in 26.6.5.9742.
   • Prioritize devices exposed to remote support sessions (support technicians’ machines, customer-access endpoints, and any machines that can host remote sessions).

2. Upgrade to the fixed version

   • Upgrade ScreenConnect to 26.6.5.9742 or later.
   • For cloud deployments: update to the latest release (and re-install/update components per vendor guidance).

3. Temporary mitigation if patching is delayed

   • While waiting for the upgrade, reduce the chance an attacker can reach or use ScreenConnect:
     • Restrict network access to ScreenConnect (e.g., limit internet exposure if currently open).
     • Tighten remote-support session controls so that unauthorized sessions are less likely.
   • Apply vendor-recommended interim mitigations from the ScreenConnect security bulletin.

4. After upgrading

   • Review whether there were any ScreenConnect sessions around the time of suspected incidents.
   • Check for suspicious file activity associated with remote sessions (new scripts/files placed and executed), and investigate endpoints showing malware indicators.

5. CISA timeline

   • The CISA KEV entry was added on 2026-09-11 and the remediation due date is 2026-09-14. Treat this as the deadline for completing mitigations/upgrade on all relevant assets.

Verdict: RED. CVE-2026-84869 is a critical remote code execution issue in ScreenConnect related to guest-to-host file execution via file-transfer actions (CWE-269, CWE-862). The core mechanism described is unauthorized file transfer and execution during an active remote session without proper Host confirmation in specific circumstances. CISA KEV confirms real-world exploitation and requires prioritizing security updates; news reporting describes worm-like attacks and campaigns deploying VBScript payloads, including modified ScreenConnect instances used to propagate to other clients. No public exploit code was found in the provided findings. EPSS prediction is reported as 0.7% with a flat trend, but this should not reduce urgency because KEV/news confirm active exploitation. What KEV means here: CISA added this CVE to its Known Exploited Vulnerabilities catalog, indicating it is being used in the wild; exploitation maturity is therefore “in active use.” Fixed version: screenconnect fixed in 26.6.5.9742.