CVE-2026-84869: Unrestricted File Transfer and Remote Execution in ConnectWise ScreenConnect Client via Active Session Authorization Bypass

HERMES

HERMES THREAT SCORE & REMOTE ACCESS AGENT COMPROMISE

Target: ConnectWise ScreenConnect (Remote Desktop & Support Client)

Confidence: 99%

98 / 100

CRITICAL

Measures real-world operational relevance, exploit weaponization, and active threat posture.

Dimension Breakdown

Exploitability 20 / 20

Threat Activity 20 / 20

Weaponization 20 / 20

Exposure 18 / 20

Prevalence 19 / 20

Impact 20 / 20

Exploit Maturity 20 / 20

Attack Chain Potential 20 / 20

⚖️ Divergence & Operational Rationale

CVSS v3.1 rates CVE-2026-84869 at 9.9 (Critical, CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). The Hermes Threat Score assesses the vulnerability at 98 (CRITICAL). This alignment highlights extreme operational risk: an authenticated participant in an active ScreenConnect session can silently transfer files and invoke arbitrary binaries with SYSTEM privileges on client endpoints without host authorization or visual confirmation.

🕸️ Connected Knowledge Graph & Provenance

CVE-2026-84869: Unrestricted File Transfer and Remote Execution in ConnectWise ScreenConnect Client via Active Session Authorization BypassVULNERABILITY

Connected Nodes: 2

Active Relationships (Outgoing)

→ affectsPRODUCTConnectWise ScreenConnect

98% VERY_HIGH

Software platform affected by security vulnerabilities and agentic attack patterns.

🔍 Why is this related? (Evidence & Provenance)

“Confirmed security vulnerability in ConnectWise ScreenConnect documented in Hermes dossier.”

Supporting Verified Evidence:

[vulnerability_report]
[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

→ usesATTACK TECHNIQUET1059: Command and Scripting Interpreter

90% VERY_HIGH

Adversaries abuse command and script interpreters (Bash, Python, PowerShell) to execute arbitrary commands.

🔍 Why is this related? (Evidence & Provenance)

“Attack execution telemetry aligns with MITRE ATT&CK technique T1059.”

Supporting Verified Evidence:

[government_confirmation]CISA verified active exploitation in the wild and mandated federal remediation deadline in KEV entry. — Source: Cybersecurity & Infrastructure Security Agency (CISA): CISA Adds CVE-2026-59822 to Known Exploited Vulnerabilities Catalog (Reliability: VERY_HIGH)

CVE-2026-84869 is a critical privilege escalation and remote code execution vulnerability impacting the client software of ConnectWise ScreenConnect (formerly ConnectWise Control). ScreenConnect is widely deployed by Managed Service Providers (MSPs) and enterprise IT helpdesks to remotely manage thousands of endpoints.

The vulnerability resides in the ScreenConnect client and session-handling routines. In affected client versions, the communication protocol fails to properly enforce authorization checks and host confirmation dialogs when processing file transfer and binary execution commands sent over an active session channel. An attacker who establishes or joins an active remote session (via guest links, compromised low-privilege technician credentials, or session hijacking) can silently transfer arbitrary binaries and trigger their execution on target endpoints under the security context of the ScreenConnect service (typically NT AUTHORITY\SYSTEM on Windows), completely bypassing the visual prompt and confirmation mechanisms intended to safeguard end users.

1. Technical Context & Affected Software Matrix

ScreenConnect operates via a centralized relay server architecture connecting administrative technicians (“Hosts”) to end-user systems (“Guests” or unattended agents).

Parameter	Technical Specification	Threat Intelligence Context
CVE Identifier	`CVE-2026-84869`	Official NVD & CISA KEV record
Common Weakness Enumeration	`CWE-862` (Missing Authorization), `CWE-269` (Improper Privilege Management)	Session message handling logic failure
Network Vector	Network over ScreenConnect Relay (`8040/TCP`, `8041/TCP`, HTTPS)	Session-encapsulated command channels
Vulnerable Component	ScreenConnect Client (`ScreenConnect.ClientService.exe` / `ScreenConnect.WindowsClient.exe`)	Session file-transfer and execution handler
Affected Versions	All ScreenConnect Client versions `< 26.6.5` (`< 26.6.5.9742`)	Windows, macOS, and Linux client endpoints
Remediated Version	`26.6.5` (`26.6.5.9742`)	Official patch release (Sept 8, 2026)
CISA KEV Inclusion	September 11, 2026 (Due: September 14, 2026)	Forensic Triage: Yes (BOD 26-04)
Threat Actor Activity	Active in the wild (Ransomware Affiliates & IABs)	Silent malware dropping and lateral movement

2. In-Depth Technical Decomposition & Root Cause

A. The Client-Side Session Command Deserialization Flaw

When an active remote control or support session is established, communication packets flow through the ScreenConnect relay server. The server acts as a message router, forwarding session protocol messages between endpoints.

In client versions prior to 26.6.5, message handling routines for remote file deployment (CommandType.TransferFile and CommandType.ExecuteProcess) contained two severe architectural flaws:

Missing Authorization Validation: The client assumed that any command received over the relay session pipe was authorized by an authenticated session Host possessing full administrative privileges. It did not validate whether the session participant role had the TransferFiles or RunTool permissions configured in server-side role-based access control (RBAC).
Missing Host Confirmation Enforcement: While ScreenConnect includes policy settings requiring interactive user approval (“Prompt Guest for Permission”), the client-side parser processed raw command payloads directly from the session stream without querying the local UI dialog state:

// Conceptual representation of vulnerable client command processing
public void HandleSessionMessage(SessionMessage message)
{
    switch (message.MessageType)
    {
        case MessageType.FileTransfer:
            // VULNERABILITY: No check against Host confirmation policy or participant permissions
            string destinationPath = Path.Combine(Path.GetTempPath(), message.FileName);
            File.WriteAllBytes(destinationPath, message.Payload);

            if (message.AutoExecute)
            {
                // Executes binary directly under the Service account (SYSTEM)
                ProcessStartInfo psi = new ProcessStartInfo(destinationPath)
                {
                    UseShellExecute = false,
                    CreateNoWindow = true
                };
                Process.Start(psi);
            }
            break;
    }
}

B. Attack Flow Architecture

sequenceDiagram
    autonumber
    actor Attacker as Threat Actor (Low-Priv / Guest Session)
    participant Relay as ScreenConnect Relay Server
    participant Client as Vulnerable Client Agent (SYSTEM)
    participant Host as Victim Endpoint OS / User Desktop

    Attacker->>Relay: Connect to Active Support Session (Join / Hijack)
    Relay-->>Attacker: Session Pipe Established
    Attacker->>Relay: Transmit Crafted FileTransfer & Execute Packet (payload.exe)
    Relay->>Client: Forward Encapsulated Session Message
    Note over Client: Missing Authorization & Host Confirmation Check.<br/>Processes packet in background thread.
    Client->>Host: Write payload.exe to C:\Windows\Temp\
    Client->>Host: Process.Start("C:\Windows\Temp\payload.exe")
    Note over Host: Process spawned as NT AUTHORITY\SYSTEM!<br/>No prompt or confirmation shown on victim screen.
    Host-->>Attacker: Reverse Shell / Ransomware Deployment Established

3. Exploit Chain & Post-Exploitation Mechanics

Phase 1: Session Entry & Payload Dispatch

An attacker leverages low-privilege access to an active session—such as joining an open guest support invitation, compromising a frontline support technician account with restricted non-administrative rights, or intercepting session tokens.

Using a customized client or script interacting with the ScreenConnect session protocol, the attacker crafts a binary message instructing the target endpoint client to receive an executable file (e.g., update_agent.exe) and execute it immediately.

Phase 2: Arbitrary SYSTEM Execution

Because the unattended client service runs as a Windows Service under NT AUTHORITY\SYSTEM, the dropped binary executes with the highest local privileges. The attacker immediately achieves:

Bypassing User Account Control (UAC).
Silently executing payloads without triggering the ScreenConnect notification tray banner or interactive prompt.
Disabling local endpoint detection and response (EDR) agents or installing persistent backdoors (Cobalt Strike, Sliver, or ransomware encryptors).

4. MITRE ATT&CK Mapping

Tactic	Technique ID	Technique Name	Technical Manifestation
Initial Access	`T1190`	Exploit Public-Facing Application	Exploitation of active session channels via remote relay
Execution	`T1059.003`	Command and Scripting Interpreter: Windows Command Shell	Silent binary and script execution via client agent
Privilege Escalation	`T1068`	Exploitation for Privilege Escalation	Escalation from session guest to `NT AUTHORITY\SYSTEM`
Defense Evasion	`T1218`	System Binary Proxy Execution	Proxying file drops and execution through signed ScreenConnect binaries
Lateral Movement	`T1219`	Remote Access Software	Leveraging MSP remote management infrastructure across customer fleets

5. Detection Opportunities & SIEM Telemetry

A. Sigma Rule: Suspicious Child Process Spawned by ScreenConnect

title: Suspicious Child Process Spawned by ScreenConnect Client
id: d7c9a2e4-8486-4b19-9012-cve202684869
status: production
description: Detects unusual processes spawned by ScreenConnect client service, indicative of CVE-2026-84869 exploitation
author: Hermes Codex Cyber Threat Intelligence
date: 2026-09-11
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
      - '\ScreenConnect.ClientService.exe'
      - '\ScreenConnect.WindowsClient.exe'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\certutil.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\bitsadmin.exe'
  condition: selection
fields:
  - ComputerName
  - User
  - ParentImage
  - Image
  - CommandLine
falsepositives:
  - Legitimate administrative scripts dispatched intentionally by verified technicians
level: critical
tags:
  - attack.execution
  - attack.t1059.003
  - attack.privilege_escalation
  - attack.t1068
  - cve.2026.84869

B. Suricata Network Detection Rule (Relay Traffic)

alert tcp $EXTERNAL_NET any -> $HOME_NET [8040,8041] (
  msg:"HERMES - ConnectWise ScreenConnect Client Unconfirmed File Transfer Attempt (CVE-2026-84869)";
  flow:established,to_server;
  content:"ScreenConnect"; nocase;
  content:"TransferFile"; distance:0;
  content:"ExecuteProcess"; distance:0;
  classtype:attempted-admin;
  sid:202684869;
  rev:1;
  reference:cve,2026-84869;
)

6. DFIR Forensics, Artifacts & Hunting Protocol

Forensic Triage Protocol (CISA BOD 26-04 Compliance)

Because CISA designated CVE-2026-84869 with Forensic Triage: Yes, incident responders must conduct endpoint triage across all hosts running ScreenConnect client versions prior to 26.6.5:

Inspect ScreenConnect Client Session Logs: Examine %ProgramData%\ScreenConnect\App_Data\*.log or %TEMP%\ScreenConnect\*.log for session event entries showing file transfers without associated Host authorization prompts.

Review Windows Security Event Logs (Event ID 4688 / Sysmon Event ID 1): Filter for process creation events where ParentProcessName equals ScreenConnect.ClientService.exe and ProcessCommandLine executes binaries out of temporary directories:

Get-WinEvent -FilterHashtable @{LogName='Security';ID=4688} | Where-Object {
    $_.Properties[13].Value -match 'ScreenConnect' -and
    $_.Properties[5].Value -match 'Temp|AppData'
} | Select-Object TimeCreated, @{N='Parent';E={$_.Properties[13].Value}}, @{N='Process';E={$_.Properties[5].Value}}

File System Artifacts: Inspect %SystemRoot%\Temp\ and %LOCALAPPDATA%\Temp\ for unknown executable or DLL files timestamped concurrently with active remote support sessions.

7. Mitigation, Patching & Host Client Deployment

Server-Side Upgrade: Self-managed ScreenConnect servers must be updated to version 26.6.5 (build 26.6.5.9742) or higher immediately.
Reinstall Host Client on Endpoints: Updating the server is not sufficient to secure client endpoints. Administrators must ensure that all unattended and host client agents are updated to build 26.6.5.9742:
- In the ScreenConnect Web Console, execute a global “Reinstall Host Client” action across all managed session groups.
- For ScreenConnect Cloud instances, the server patch is applied automatically, but verification of client agent version compliance is mandatory.
Session Access Restrictions: Enforce multi-factor authentication (MFA) on all technician accounts and disable unauthenticated guest session links until all endpoints have verified agent upgrades.