CVE-2026-84869 is a ConnectWise ScreenConnect client vulnerability that can, under specific circumstances, allow files to be transferred and executed during an active remote session without authorization or Host confirmation. ConnectWise assigns a CVSS 3.1 score of 9.9 and fixes the issue in ScreenConnect 26.6.5.

The attack model matters. ConnectWise explicitly states that ScreenConnect servers are not affected. Treating this as an unauthenticated server-side RCE would therefore overstate what the vendor advisory documents.

What the ConnectWise bulletin establishes

The September 8, 2026 security bulletin maps CVE-2026-84869 to CWE-862, Missing Authorization, and CWE-269, Improper Privilege Management. The published vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

The vulnerable behavior concerns client-side file-transfer and file-execution actions within an active remote session. Under certain conditions, those actions can occur without the expected authorization or Host confirmation.

Two details should remain explicit in any risk assessment: the vector contains PR:L, not PR:N, and the vendor describes an active remote session as part of the condition.

Why the impact is still critical

Remote-access software sits close to the administrative boundary of an endpoint. A failure in the control that separates a remote session from file delivery and execution can have a high impact on confidentiality, integrity and availability.

That explains the 9.9 score without changing the prerequisites documented by ConnectWise. Severity and exploit model are related, but they are not interchangeable.

Fixed release

ConnectWise identifies ScreenConnect 26.6.5 or later as the remediation. The update strengthens client and session handling for file-transfer and file-execution actions.

For self-managed deployments, simply knowing that a patch exists is not enough. Administrators should confirm the version actually deployed and follow the vendor's procedure for the relevant clients and agents.

Defensive verification

A practical defensive review can follow four steps:

  1. inventory ScreenConnect deployments and distinguish Cloud from On-Premise environments;
  2. verify the installed release and update to at least 26.6.5 according to ConnectWise guidance;
  3. confirm the expected client and agent state after the update;
  4. review session and file-transfer logs for unexpected activity during the pre-remediation period.

The final step is a prudent incident-response check. A vulnerable version alone does not prove compromise.

What the advisory does not say

The vendor bulletin does not state that every Internet-facing ScreenConnect server can be compromised without authentication. Nor should the 9.9 score be used to infer technical capabilities beyond the documented condition.

The useful prioritization signal is the combination of remote-access software, file transfer and execution, an active session, and insufficient authorization around those actions.

Sources