CVE-2026-84869

Name of the Vulnerable Software and Affected Versions ConnectWise ScreenConnect versions prior to 26.6.5

Description A flaw in the ScreenConnect client allows files to be transferred and executed through an active remote session without authorization or host confirmation under certain circumstances. This issue has been exploited in real-world worm-like attacks where victims were tricked via social engineering into running rogue ScreenConnect clients. These modified clients identified other active sessions on the same network to push and execute four VBScript payloads, establishing persistence through a WindowsServiceHost registry Run key and propagating across the organization's remote support footprint.

Recommendations Update ConnectWise ScreenConnect to version 26.6.5. As a temporary mitigation, disable the TransferFiles permission.