CVE-2026-84869 in ScreenConnect
Summary
by MITRE • 09/08/2026
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified within the ScreenConnect client represents a critical failure in access control mechanisms, specifically allowing for unauthorized file transfer and execution during an active remote support session. This flaw stems from insufficient validation of user permissions and lack of explicit host consent for specific high-risk operations. In typical secure remote desktop architectures, actions that modify system state or introduce external code require clear acknowledgment by the local machine's operator to prevent malicious activity under the guise of legitimate technical support. However, in this instance, the client software permits these actions without triggering a confirmation dialog or verifying administrative privileges on the host side, effectively bypassing standard security safeguards designed to protect endpoint integrity.
From a technical perspective, this issue aligns with CWE-269, which describes Improper Privilege Control, as well as CWE-749, Exposed Dangerous Method in an Object-Oriented Program, where dangerous methods are accessible without proper checks. The vulnerability allows an attacker who has compromised the remote support agent or gained access to a session to execute arbitrary files on the target machine. This capability transforms what should be a diagnostic tool into a potent vector for malware deployment and persistence establishment. Since ScreenConnect servers themselves are not impacted, the risk is localized strictly to endpoints running vulnerable versions of the client software, making it an endpoint-specific exploitation scenario rather than a server-side compromise.
The operational impact of this vulnerability is severe, particularly in enterprise environments where remote support tools are frequently used by IT administrators and third-party vendors. An adversary could leverage this flaw to deploy ransomware, keyloggers, or other malicious payloads directly onto the victim's machine without their knowledge. This bypasses traditional perimeter defenses because the traffic appears as legitimate remote session data. Furthermore, since no host confirmation is required, social engineering attacks become significantly more effective; an attacker merely needs to convince a user to initiate a support session, after which they can silently install backdoors or exfiltrate sensitive data without raising suspicion through unexpected permission prompts.
This behavior also maps directly to the MITRE ATT&CK framework under techniques such as T1059 Command and Scripting Interpreter for execution and T1204 User Execution if combined with social engineering, though in this case, user interaction is minimized due to the lack of confirmation dialogs. It facilitates lateral movement by allowing attackers to establish a foothold on one machine that can be used to pivot to other systems within the network. The absence of host-side verification removes a crucial layer of defense-in-depth, relying entirely on the assumption that only authorized personnel will initiate sessions, which is often an unrealistic security posture in dynamic organizational environments.
Mitigation strategies must prioritize immediate patching of all ScreenConnect client instances to versions where this authorization check has been enforced. Organizations should implement strict network segmentation policies to limit remote support traffic to essential systems and monitor for unusual file execution patterns during active sessions. Additionally, deploying endpoint detection and response solutions that can identify anomalous process creation or script execution originating from known remote desktop applications will provide an additional layer of visibility. Security teams should also review access logs to ensure that only authorized personnel have the ability to initiate support sessions, reducing the attack surface available for exploitation by threat actors seeking initial access through social engineering or credential theft.