ScreenConnect flaw already exploited since August -- patch clients and agents to 26.6.5+

ConnectWise has published a Priority-1 High bulletin for CVE-2026-84869, a CVSS 9.9 flaw in ScreenConnect that affects remote-access clients and access agents. According to the vendor, servers are not impacted, but the client-side issue has already been exploited in the wild.

What the flaw allows

The vulnerability, classified under CWE-862 (missing authorization) and CWE-269 (improper privilege management), can let files be transferred and executed through an active remote-access session without authorization or host confirmation under certain conditions. Huntress has reported that the flaw has been exploited since 20 August, documenting three incidents in which attackers distributed malicious VBScript payloads through compromised ScreenConnect sessions. CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on 11 September, with a federal remediation deadline of 14 September -- already passed.

What to patch, and how

ScreenConnect Cloud deployments have already been updated automatically. On-premise deployments need to be running version 25.4 or later before they can upgrade to the fixed 26.6.5 release, and administrators must also reinstall host clients and access agents to pick up the fix -- updating the server alone is not enough.

ConnectWise offers an interim mitigation for teams still working through the upgrade: in Administration > Security > Roles, deselect the TransferFiles permission on each session-group role. This reduces risk temporarily but is not a substitute for the 26.6.5 update.

Given confirmed exploitation since late August and a passed federal deadline, treat this as an immediate-priority patch for any MSP running ScreenConnect on-premise, not a routine maintenance-window item.

Sources: ConnectWise security bulletin, SecurityWeek.