CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
Overview
ConnectWise ScreenConnect contains a missing authorization and improper privilege management flaw in its client-side file-transfer handling. During an active remote session, the client fails to enforce authorization checks or require Host confirmation before processing file-transfer and file-execution requests. An attacker who controls the remote side of a session can transfer files to and execute them on the Host client system, potentially with elevated privileges. All ScreenConnect versions prior to 26.6.5 are affected; ScreenConnect servers are not impacted.
Vulnerability details
The vulnerability resides in the ScreenConnect client's session handling for file-transfer and file-execution actions. Under CWE-862 (Missing Authorization), the client processes these requests without verifying that the requesting party is authorized to perform them or that the Host has confirmed the action. CWE-269 (Improper Privilege Management) compounds this: once a file-transfer command is accepted, execution can occur at privilege levels beyond what the session role should permit, crossing the trust boundary between the remote guest and the Host system.
An attacker who holds the remote side of an active ScreenConnect session sends crafted file-transfer and file-execution commands that the vulnerable client accepts without authorization checks or Host confirmation. This requires at minimum low-privilege session access, consistent with the established session precondition. Successful exploitation results in arbitrary file delivery and execution on the Host client system, potentially at elevated privilege, yielding full confidentiality, integrity, and availability impact on that host. Huntress observed this mechanism exploited in the wild, with rogue ScreenConnect clients spawning child processes to execute staged payloads on connected endpoints.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Monitor ScreenConnect.WindowsClient.exe for unexpected child process creation, specifically wscript.exe or other scripting hosts. Legitimate ScreenConnect sessions do not routinely spawn script interpreters; any such child process warrants immediate investigation.
- Audit Windows Run keys (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) for entries pointing to VBScript files in user AppData directories, a persistence indicator observed in active exploitation of this flaw.
Remediation
Additional hardening
- Upgrade ScreenConnect to version 26.6.5.9742 or later. On-premises partners must apply the update manually; cloud instances are updated automatically but require host client reinstallation and access agent updates afterward.
- As a temporary compensating control if patching is delayed, navigate to Administration > Security > Roles, edit each role, and deselect the TransferFiles permission for every session group. This reduces exposure but does not replace the patch.
- Restrict ScreenConnect server access to known technician IP ranges at the network perimeter, reducing the pool of accounts that can establish sessions and limiting the attacker's ability to reach the vulnerable client-side code.
- Review the ScreenConnect audit log for file-transfer events occurring outside normal support hours or from accounts with no corresponding helpdesk ticket, and force all technicians to re-authenticate following any suspected compromise.
Key dates
References
- https://www.connectwise.com/company/trust/advisories
- https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2026-84869
- https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869
- https://www.huntress.com/blog/rogue-screenconnect-installations
Frequently asked questions
Does CVE-2026-84869 affect my FedRAMP authorization?
If ConnectWise ScreenConnect runs inside your authorization boundary, CVE-2026-84869 is your problem. CISA listed it in the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of September 14, 2026, a date that has already passed. For a FedRAMP-authorized service, an unpatched KEV in the boundary is an assessor finding. An overdue one is visible to both your assessor and your sponsoring agency now. Your options are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2026-84869?
Knox does not patch ConnectWise ScreenConnect on your behalf. Under the FedRAMP shared-responsibility model, that remediation is yours to own. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, plus Knox's automated continuous monitoring platform and audit-artifact coverage to document the fix for your next assessment. Applying the patch is your responsibility. Managing your compliance posture while you do it does not have to be something you handle alone.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment continuously for newly disclosed vulnerabilities and compliance issues, including ones like CVE-2026-84869. Exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you the earliest possible window to act.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2026-84869's remediation deadline of September 14, 2026 has passed. What happens now?
An unremediated CVE-2026-84869 is already a Plan of Action and Milestones (POA&M) item. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult agency conversation. Closing out the finding and documenting why the deadline was missed is what keeps your authorization intact and the agency relationship on solid footing.
Ready to achieve FedRAMP authorization in 90 days or less?
Schedule a meeting to discuss scope, parse readiness, and map your company’s accelerated path to FedRAMP authorization.
_Horizontal_RGB.png)
