EUVD-2026-74053
GHSA-rc8v-f46m-jcgm
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker needs a low-privilege role in an active session (PR:L) over the network with no Host interaction (UI:N); bypassing session controls to compromise the host OS crosses trust boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (7d616e1a-3288-43b1-a0dd-0a65d3e70a49).
CVSS VectorVendor: 7d616e1a-3288-43b1-a0dd-0a65d3e70a49
Lifecycle Timeline
5DescriptionCVE.org
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
AnalysisAI
Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a party to an active remote session push and run files on the Host machine without authorization or the Host's confirmation under certain circumstances. This turns a legitimate support session into a code-execution channel against the remote endpoint; ScreenConnect servers are explicitly not affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an active ScreenConnect remote session to the target Host and the attacker having some role/privilege within that session (reflected by PR:L); the described behavior bypasses the normal Host authorization/confirmation step for transferred files. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a low-complexity, network-reachable path requiring only limited privilege (participation in an active session) and no user interaction, yielding full host compromise - a genuine high priority for anyone running the ScreenConnect client. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade the ScreenConnect client to version 26.6.5 or later as the primary fix, per the ConnectWise security bulletin dated 2026-09-08 (https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin) and the disclosure at https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately catalog all systems running ScreenConnect client and risk-rate them by data sensitivity and criticality (within 24 hours). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Screenconnect
View allPath traversal in ConnectWise ScreenConnect 23.9.7 and earlier enables attackers with administrative privileges to write
A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom acce
ScreenConnect versions prior to 26.2 permit an authenticated user holding Host Pass creation privileges to bypass the in
ConnectWise ScreenConnect 25.2.3 and earlier may be susceptible to ViewState code injection when machine keys are compro
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today