CISA has added a critical ConnectWise ScreenConnect vulnerability, CVE-2026-84869 (CVSS 9.9), to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw lets an attacker transfer a file to a device and execute it during an active remote session, without authorization or a confirmation prompt from the person on the other end.
Why this one is different from a normal RCE
ScreenConnect is a remote-access tool IT teams and MSPs run on thousands of endpoints specifically so a technician can act on a machine from anywhere. That is also exactly what makes an improper-authorization bug in its file transfer function so dangerous: the abuse path looks like normal remote support traffic to anyone monitoring the network, right up until a malicious binary lands on disk and runs.
Huntress has already reported three incidents where attackers rode an active ScreenConnect session to push malicious VBScript payloads onto newly connected systems. ConnectWise patched the issue on September 8, CISA gave federal agencies until September 14 to remediate, and more than 1,000 exposed instances were still unpatched online at last count.
What to do now
- Upgrade ScreenConnect to 26.6.5 or later. As an immediate stopgap, deselect the TransferFiles permission under Administration, Security, Roles.
- Treat every RMM tool in your environment as a high-value target, not a trusted utility. External network penetration testing is what actually finds the exposed management consoles nobody remembers leaving open.
- Assume one of these consoles gets abused eventually and measure the blast radius with an assumed-breach assessment, since a compromised RMM session inherits trusted, privileged reach across every endpoint it manages.
- Segment who can even reach the ScreenConnect server with a firewall configuration review. Management planes should never sit flat on the same network as everything they administer.
The takeaway
A privilege check missing in a remote-support tool turns a legitimate feature into a file-drop mechanism attackers do not even need to disguise. Patch fast, and stop treating remote-access software as exempt from the same scrutiny you apply to everything else on the perimeter.