EUVD-2026-74053
GHSA-rc8v-f46m-jcgm
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessJoin or leverage active remote session
-
DeliveryTransfer malicious file to Host
-
ExploitBypass Host confirmation control
-
ExecutionExecute payload on endpoint
-
ImpactFull host compromise
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an active ScreenConnect remote session to the target Host and the attacker having some role/privilege within that session (reflected by PR:L); the described behavior bypasses the normal Host authorization/confirmation step for transferred files. Vendor notes it occurs 'in certain circumstances,' indicating it is not universal to every session state. Limiting factors: it applies only to the ScreenConnect client (servers are unaffected), only to versions prior to 26.6.5, and presupposes an active session context rather than fully anonymous internet access. |
| Impact | The vendor CVSS of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) reflects a low-complexity, network-reachable path requiring only limited privilege (participation in an active session) and no user interaction, yielding full host compromise - a genuine high priority for anyone running the ScreenConnect client. The PR:L and 'in certain circumstances' language are the key limiters: exploitation is not fully self-standing, it presupposes an active remote session context rather than arbitrary internet-wide unauthenticated access, so this is not a spray-and-pray internet worm scenario. No EPSS score, KEV listing, or POC was provided in the input; absence of these is not evidence of safety, but there is currently no confirmed active exploitation. Given ConnectWise ScreenConnect's history of being heavily exploited by ransomware actors, defenders should treat this as urgent despite the lack of exploitation telemetry here. |
| Exploit ScenarioDerived | During or by joining an active ScreenConnect remote session to a Host, an attacker pushes a malicious executable to the endpoint and triggers its execution without any confirmation prompt appearing to the Host, gaining code execution on the target machine. No public POC is identified at this time, but the low attack complexity and lack of required user interaction make weaponization straightforward once conditions are understood. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 08, 2026
Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a party to an active remote session push and run files on the Host machine without authorization or the Host's confirmation under certain circumstances. This turns a legitimate support session into a code-execution channel against the remote endpoint; ScreenConnect servers are explicitly not affected. No public exploit identified at time of analysis, though the client's remote-support role makes it an attractive target.
RemediationAI
Vendor-released patch: upgrade the ScreenConnect client to version 26.6.5 or later as the primary fix, per the ConnectWise security bulletin dated 2026-09-08 (https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin) and the disclosure at https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869. Because the defect is client-side, ensure endpoint agents/clients are updated, not just server infrastructure. Until clients are patched, limit who can establish or join remote sessions, restrict session creation to trusted technicians, monitor session logs for unexpected file-transfer/execution events, and consider temporarily disabling or tightly controlling the file-transfer capability during sessions - noting that disabling file transfer removes a core support workflow and monitoring alone does not prevent execution.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ScreenConnect (a ConnectWise remote monitoring and management / remote-support product) normally gates file transfer and execution during a session behind Host consent so the machine owner controls what runs. The flaw is classified CWE-269 (Improper Privilege Management): the client fails to enforce the authorization/confirmation control before accepting and executing transferred files, so an action that should require explicit Host approval proceeds without it. Because the impact crosses the session's trust boundary to fully compromise the underlying Host operating system, the vendor scores it with scope change (S:C). No CPE strings were provided; affected components are limited to the ScreenConnect client, not server infrastructure.
Know when Screenconnect gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attacker needs a low-privilege role in an active session (PR:L) over the network with no Host interaction (UI:N); bypassing session controls to compromise the host OS crosses trust boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (7d616e1a-3288-43b1-a0dd-0a65d3e70a49).
CVSS VectorVendor: 7d616e1a-3288-43b1-a0dd-0a65d3e70a49
Lifecycle Timeline
2DescriptionCVE.org
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Technical POC Analysis
The flaw is CWE-269 Improper Privilege Management in the ConnectWise ScreenConnect client.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Latest POC
1 PoC candidate from github (unverified)
Sign in to open the public PoC links collected for this CVE.
Executive ViewAI
ConnectWise ScreenConnect client (versions prior to 26.6.5) permits unauthorized file execution during remote support sessions without user authorization or consent. No public exploit identified at time of analysis. However, the absence of any available patch combined with ScreenConnect's broad deployment for managed IT support leaves organizations exposed to silent code injection attacks during routine helpdesk interactions.
Restrict remote sessions to internal network access only using firewall segmentation; disable unattended access mode within ScreenConnect client configuration; deploy real-time file integrity monitoring (FIM) on all ScreenConnect-managed endpoints to detect unauthorized file writes; enforce multi-factor authentication for all technician accounts; maintain comprehensive session logs with automated alerting on anomalous file transfers; consider temporarily routing non-critical support requests through alternative communication channels pending patch availability.
Threat Model
5 threats: Elevation of Privilege, Tampering, Information Disclosure and 1 more
5-step attack chain with trust boundaries and controls
Full threat model - attack chain, trust boundaries, controls per stage and evidence - is part of the Pro and Business plans.
Threat Intelligence Overview
NVD
CVE.org
CISA KEV
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Screenconnect
View allPath traversal in ConnectWise ScreenConnect 23.9.7 and earlier enables attackers with administrative privileges to write
Integrity-check and server-side validation weaknesses in the ConnectWise ScreenConnect server's extension subsystem allo
A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom acce
ScreenConnect versions prior to 26.2 permit an authenticated user holding Host Pass creation privileges to bypass the in
ConnectWise ScreenConnect 25.2.3 and earlier may be susceptible to ViewState code injection when machine keys are compro
Exploit-DB