CVE-2026-84869
Description
CVE-2026-84869 is a critical (9.9) vulnerability in ConnectWise ScreenConnect allowing unauthorized file execution. Affects versions before 26.6.5.9742.
CPE
| Product | Version Start | Version End (excl.) | Status |
|---|---|---|---|
| screenconnect | * | 26.6.5.9742 | vulnerable |
Related weakness (CWE)
Remediation plan
Apply official patches
Download and install the latest security updates from the ConnectWise Trust Center. Ensure all ScreenConnect client instances are updated to version 26.6.5.9742 or later to address the underlying authorization bypass flaw.
Update affected systems
Identify all endpoints running ScreenConnect versions prior to 26.6.5.9742. Prioritize updates for systems with direct internet exposure or those used for critical administrative remote support tasks to minimize the attack surface.
Restrict access
Implement network-level restrictions to limit ScreenConnect traffic to known, trusted IP addresses. Use firewall rules or VPNs to ensure that remote sessions can only be initiated from authorized management consoles and authenticated users.
Monitor for exploitation
Audit ScreenConnect session logs for unusual file transfer activity or execution commands that lack corresponding host approval. Watch for unauthorized child processes spawned by the ScreenConnect client service, such as cmd.exe or PowerShell.
Detection Guidance
"To detect potential exploitation, monitor ScreenConnect logs for file transfer events initiated without host confirmation. Look for suspicious child processes originating from the ScreenConnect client executable. Network-side, inspect traffic for unusual data exfiltration patterns or unauthorized remote execution commands. Review CISA’s Forensics Triage Requirements to identify specific artifacts left behind by attackers exploiting this unauthorized file execution vulnerability in your environment."