ConnectWise has released emergency updates addressing a critical vulnerability in its ScreenConnect remote desktop software, tracked as CVE-2026-84869 with a CVSS score of 9.9. The security flaw stems from improper privilege management and missing authorization within the ScreenConnect client session handling architecture. An attacker with minimal session privileges can bypass interaction barriers to initiate unauthorized file transfers and execute arbitrary binaries directly on target host endpoints through active remote sessions without requiring user interaction, administrative approval, or host confirmation.

Telemetry confirms threat actors are actively weaponizing the flaw in automated, worm-like campaigns, compromising ScreenConnect instances to deploy malicious VBScript files for persistent secondary command-and-control access and rapid cross-session propagation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog under an emergency federal remediation mandate. The vulnerability affects all on-premises ScreenConnect releases prior to version 26.6.5, with threat monitoring services reporting more than 1,000 unpatched instances exposed online. ConnectWise has urged administrators to immediately upgrade to version 26.6.5 or higher, or revoke TransferFiles permissions as an interim mitigation.

Why it matters:

• Automated endpoint takeover via trusted management software: Exploiting authorization boundaries in remote desktop tooling bypasses endpoint detection and perimeter defenses, granting attackers silent, unauthenticated arbitrary code execution under the authority of trusted management software.
• Urgent fleet remediation and forensic verification: Defenders must immediately upgrade on-premises ScreenConnect deployments to version 26.6.5 or restrict session file-transfer permissions, while auditing environments for anomalous script activity, as binary patching does not dislodge pre-existing attacker footholds.