ConnectWise ScreenConnect Client Remote Code Execution (RCE) and Privilege Escalation (CVE-2026-84869)
Executive & SecOps Summary
SECOPS ASSESSMENTConnectWise ScreenConnect client software (Servers are not impacted)
Attackers can exploit active remote sessions to transfer and execute malicious files without host confirmation, leading to full system compromise.
Immediately update all ScreenConnect clients to the latest patched version and enforce session consent policies.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND- Immediate Patching: Deploy the latest security update provided by ConnectWise to all managed endpoints.
- Enforce Consent: Configure the ScreenConnect administration console to mandate 'Consent to Control' and 'Consent to File Transfer' for all session types.
- Threat Hunting: Monitor for suspicious child processes spawned by
ScreenConnect.Client.exeand audit file creation events in%APPDATA%or%TEMP%directories.
# Example: Check ScreenConnect version on Linux endpoints
/opt/screenconnect-*/App_Runtime/bin/ScreenConnect.Client --versionStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
CVE-2026-84869 is a critical vulnerability in the ConnectWise ScreenConnect client caused by improper privilege management (CWE-269) and missing authorization (CWE-862). The flaw allows an attacker with access to an active session to bypass the mandatory host confirmation for file transfers and subsequent execution. As this vulnerability is included in CISA's Known Exploited Vulnerabilities (KEV) catalog and carries a CVSS score of 9.9, it represents an extreme risk. Threat actors are known to leverage this to deploy ransomware or maintain persistence on compromised endpoints without any visual cues to the end-user.
Official Vendor Advisories & References
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.