ScreenConnect CVE-2026-84869: Guest-to-Host File Execution

What to do

1. Upgrade on-premises ScreenConnect servers to 26.6.5 or later; renew maintenance first if your license has lapsed.
2. Reinstall host clients on every technician machine and update access agents, on Cloud and on-premises alike.
3. Until that is done, remove the TransferFiles permission (TransferFilesInSession on older versions) from every role under Administration > Security > Roles.
4. Review ScreenConnect users and roles, remove anyone unrecognized, change passwords and enforce MFA.
5. Reimage any technician or endpoint machine that shows the indicators below, rather than cleaning it in place.

How to check if you are affected or compromised

• Search ScreenConnect audit logs for RunFiles or RanFiles events with Process: Guest, especially for files named 1.vbs through 4.vbs.
• On Windows machines, look for a WindowsServiceHost value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a .vbs file in AppData.
• Look for wscript.exe launched by ScreenConnect processes, and for %TEMP%\value.txt, %TEMP%\map.txt or %TEMP%\runner.ps1.
• Hunt for unexpected ScreenConnect installs (for example client ID 7a4d7d66502d4260), Themes.exe tunneling to homehub.opik[.]net or SearchIndex.exe mining.

What happened#

On September 3, 2026, ConnectWise posted a Guest File Transfer Advisory. It said it had "identified an issue affecting file transfer behavior" in ScreenConnect Remote Access Support and Access sessions, on both Cloud and on-premises, and gave an interim workaround: remove the TransferFiles permission. On September 8 it published the ScreenConnect 26.6.5 security bulletin and assigned CVE-2026-84869. The CVE record is titled "Guest-to-Host File Execution via File-Transfer Actions." It says a condition in the ScreenConnect client "may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances." ConnectWise's disclosure adds that the files can run on the host system, "including with elevated privileges."

In ScreenConnect terms, the host is the technician and the guest is the machine being supported. The flaw runs in the unusual direction, from guest to technician. ConnectWise scores it CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C) with CWE-862 and CWE-269, and gave it Priority 1, which means install within days. The CVE record notes that "ScreenConnect servers are not impacted." CISA added it to the KEV catalog on September 11, with a September 14 deadline.

Who is affected#

All ScreenConnect client versions before 26.6.5 are affected. ConnectWise upgraded Cloud servers automatically, but on both Cloud and on-premises it says host clients must be reinstalled and access agents updated after the upgrade. A patched server alone does not protect a technician who is still running an old client. On-premises partners need a license under active maintenance to download 26.6.5. Automate partners with Assurance can get it through Automate Product Updates.

Do you really need to act?#

Yes, if your technicians connect to machines you do not fully control. Huntress tracked incidents on August 20 and 24 in which victims installed rogue ScreenConnect clients after a tech-support scam, a phishing MSI or a fake Geek Squad refund page. The modified clients ran four VBScripts (1.vbs to 4.vbs) that installed hidden ScreenConnect backdoors, a wstunnel tunnel and an XMRig miner. They also watched for new host connections and pushed the same scripts as a file-transfer "run" action, so the connecting machine ran them too. Huntress called the spread "worm-like." Huntress's John Hammond told Help Net Security that Huntress believes attackers used this CVE. ConnectWise had not confirmed that link as of September 7, and its bulletin shares no further detail.

The precondition is a malicious or compromised guest, which keeps this from being a mass internet scan-and-own bug. But technician laptops are high-value machines, and help desks connect to unknown endpoints every day. ScreenConnect has a history of exploitation. BleepingComputer counts four ScreenConnect issues in KEV since 2024, two of them used in ransomware attacks. This is a different flaw from the 2024 server authentication bypass, CVE-2024-1709.

What to do now#

1. On-premises: upgrade the server to 26.6.5 or later and confirm the running version.
2. Reinstall the host client on every technician machine and update access agents. Do this on Cloud too.
3. Until clients are updated, open Administration > Security > Roles and untick TransferFiles (TransferFilesInSession on older versions) for every role. ConnectWise says this needs no upgrade but is not a substitute for one.
4. Follow the bulletin's post-patch steps: remove unrecognized users, review roles, change passwords and enable MFA.

How to tell if you were hit#

Search the ScreenConnect audit log for RunFiles or RanFiles events with Process: Guest, especially for 1.vbs through 4.vbs. Huntress treats any such entry as immediately suspicious, because filenames can change. On Windows, check reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsServiceHost, and look for wscript.exe children of ScreenConnect processes and for %TEMP%\value.txt, map.txt or runner.ps1. Huntress also lists the rogue client ID 7a4d7d66502d4260 and the tunnel endpoint homehub.opik[.]net. Reimage affected machines from known-good media, then rotate any credentials stored on technician machines.

Timeline#

• Aug 20, 2026 — Huntress handles the first two incidents involving rogue ScreenConnect clients and VBScript chains; a third follows on August 24.
• Sep 3, 2026 — ConnectWise publishes the Guest File Transfer Advisory with the TransferFiles workaround.
• Sep 8, 2026 — ScreenConnect 26.6.5 and CVE-2026-84869 are published; Cloud servers are upgraded.
• Sep 11, 2026 — CISA adds the CVE to KEV, due September 14.

Vulnerability records

• CVE-2026-84869 · KEV 2026-09-11 · A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. ConnectWise — ScreenConnect 26.6.5 Security Patch (CVE-2026-84869) connectwise.com
2. ConnectWise — Trust Center advisories (ScreenConnect Guest File Transfer Advisory, Sep 3, 2026) connectwise.com
3. ConnectWise Advisories — CVE-2026-84869 disclosure github.com
4. CVE record — CVE-2026-84869 cve.org
5. NVD — CVE-2026-84869 nvd.nist.gov
6. CISA — Known Exploited Vulnerabilities: CVE-2026-84869 cisa.gov
7. Huntress — Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity huntress.com

Coverage and analysis

1. Help Net Security — Attackers use rogue ScreenConnect clients to spread malware helpnetsecurity.com
2. BleepingComputer — CISA warns of hackers exploiting critical ScreenConnect flaw bleepingcomputer.com