---
title: "ScreenConnect CVE-2026-84869: Guest-to-Host File Execution"
url: https://erroneo.us/security/briefs/connectwise-screenconnect-cve-2026-84869-guest-file-execution/
description: "Exploited ScreenConnect client flaw lets a remote guest push and run files on the technician's PC. Fixed in 26.6.5; upgrade, then reinstall host clients."
type: security-brief
section: "Security Digest"
date_published: 2026-09-03
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-84869"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# ScreenConnect CVE-2026-84869: Guest-to-Host File Execution

**Verdict: Act now.** If your technicians use a ScreenConnect client older than 26.6.5, a compromised machine they connect to can run code on theirs; upgrade on-premises servers and reinstall host clients now.

- **Who must act:** MSPs, help desks and IT teams using on-premises ScreenConnect below 26.6.5, or using any ScreenConnect deployment whose technicians still run old host clients, especially when supporting untrusted or consumer endpoints.
- **Who can relax:** ScreenConnect Cloud customers who have already reinstalled host clients and updated access agents after ConnectWise's automatic 26.6.5 upgrade; the ScreenConnect server itself is not affected.
- **Affected:** ScreenConnect client, all versions before 26.6.5 (Cloud and on-premises)
- **Fixed:** ScreenConnect 26.6.5 or later, followed by reinstalling host clients and updating access agents; ScreenConnect Cloud: server upgraded automatically to 26.6.5
- **CVEs:** CVE-2026-84869
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Upgrade on-premises ScreenConnect servers to 26.6.5 or later; renew maintenance first if your license has lapsed.
2. Reinstall host clients on every technician machine and update access agents, on Cloud and on-premises alike.
3. Until that is done, remove the TransferFiles permission (TransferFilesInSession on older versions) from every role under Administration > Security > Roles.
4. Review ScreenConnect users and roles, remove anyone unrecognized, change passwords and enforce MFA.
5. Reimage any technician or endpoint machine that shows the indicators below, rather than cleaning it in place.

### How to check if you are affected

- Search ScreenConnect audit logs for RunFiles or RanFiles events with Process: Guest, especially for files named 1.vbs through 4.vbs.
- On Windows machines, look for a WindowsServiceHost value under HKCU\Software\Microsoft\Windows\CurrentVersion\Run pointing to a .vbs file in AppData.
- Look for wscript.exe launched by ScreenConnect processes, and for %TEMP%\value.txt, %TEMP%\map.txt or %TEMP%\runner.ps1.
- Hunt for unexpected ScreenConnect installs (for example client ID 7a4d7d66502d4260), Themes.exe tunneling to homehub.opik[.]net or SearchIndex.exe mining.

## What happened

On September 3, 2026, ConnectWise posted a [Guest File Transfer Advisory](https://www.connectwise.com/company/trust/advisories). It said it had "identified an issue affecting file transfer behavior" in ScreenConnect Remote Access Support and Access sessions, on both Cloud and on-premises, and gave an interim workaround: remove the TransferFiles permission. On September 8 it published the [ScreenConnect 26.6.5 security bulletin](https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin) and assigned [CVE-2026-84869](https://www.cve.org/CVERecord?id=CVE-2026-84869). The CVE record is titled "Guest-to-Host File Execution via File-Transfer Actions." It says a condition in the ScreenConnect client "may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances." ConnectWise's [disclosure](https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869) adds that the files can run on the host system, "including with elevated privileges."

In ScreenConnect terms, the *host* is the technician and the *guest* is the machine being supported. The flaw runs in the unusual direction, from guest to technician. ConnectWise scores it CVSS 3.1 9.9 (AV:N/AC:L/PR:L/UI:N/S:C) with CWE-862 and CWE-269, and gave it Priority 1, which means install within days. The CVE record notes that "ScreenConnect servers are not impacted." CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869) on September 11, with a September 14 deadline.

## Who is affected

All ScreenConnect client versions before 26.6.5 are affected. ConnectWise upgraded Cloud servers automatically, but on both Cloud and on-premises it says host clients must be reinstalled and access agents updated after the upgrade. A patched server alone does not protect a technician who is still running an old client. On-premises partners need a license under active maintenance to download 26.6.5. Automate partners with Assurance can get it through Automate Product Updates.

## Do you really need to act?

**Yes, if your technicians connect to machines you do not fully control.** [Huntress](https://www.huntress.com/blog/rogue-screenconnect-installations) tracked incidents on August 20 and 24 in which victims installed rogue ScreenConnect clients after a tech-support scam, a phishing MSI or a fake Geek Squad refund page. The modified clients ran four VBScripts (`1.vbs` to `4.vbs`) that installed hidden ScreenConnect backdoors, a `wstunnel` tunnel and an XMRig miner. They also watched for new host connections and pushed the same scripts as a file-transfer "run" action, so the connecting machine ran them too. Huntress called the spread "worm-like." Huntress's John Hammond told [Help Net Security](https://www.helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/) that Huntress believes attackers used this CVE. ConnectWise had not confirmed that link as of September 7, and its bulletin shares no further detail.

The precondition is a malicious or compromised guest, which keeps this from being a mass internet scan-and-own bug. But technician laptops are high-value machines, and help desks connect to unknown endpoints every day. ScreenConnect has a history of exploitation. [BleepingComputer](https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/) counts four ScreenConnect issues in KEV since 2024, two of them used in ransomware attacks. This is a different flaw from the 2024 server authentication bypass, CVE-2024-1709.

## What to do now

1. On-premises: upgrade the server to 26.6.5 or later and confirm the running version.
2. Reinstall the host client on every technician machine and update access agents. Do this on Cloud too.
3. Until clients are updated, open Administration > Security > Roles and untick `TransferFiles` (`TransferFilesInSession` on older versions) for every role. ConnectWise says this needs no upgrade but is not a substitute for one.
4. Follow the bulletin's post-patch steps: remove unrecognized users, review roles, change passwords and enable MFA.

## How to tell if you were hit

Search the ScreenConnect audit log for `RunFiles` or `RanFiles` events with `Process: Guest`, especially for `1.vbs` through `4.vbs`. Huntress treats any such entry as immediately suspicious, because filenames can change. On Windows, check `reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsServiceHost`, and look for `wscript.exe` children of ScreenConnect processes and for `%TEMP%\value.txt`, `map.txt` or `runner.ps1`. Huntress also lists the rogue client ID `7a4d7d66502d4260` and the tunnel endpoint `homehub.opik[.]net`. Reimage affected machines from known-good media, then rotate any credentials stored on technician machines.

## Timeline

- Aug 20, 2026 — Huntress handles the first two incidents involving rogue ScreenConnect clients and VBScript chains; a third follows on August 24.
- Sep 3, 2026 — ConnectWise publishes the Guest File Transfer Advisory with the TransferFiles workaround.
- Sep 8, 2026 — ScreenConnect 26.6.5 and CVE-2026-84869 are published; Cloud servers are upgraded.
- Sep 11, 2026 — CISA adds the CVE to KEV, due September 14.

## Sources

1. [ConnectWise — ScreenConnect 26.6.5 Security Patch (CVE-2026-84869)](https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin)
2. [ConnectWise — Trust Center advisories (ScreenConnect Guest File Transfer Advisory, Sep 3, 2026)](https://www.connectwise.com/company/trust/advisories)
3. [ConnectWise Advisories — CVE-2026-84869 disclosure](https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869)
4. [CVE record — CVE-2026-84869](https://www.cve.org/CVERecord?id=CVE-2026-84869)
5. [NVD — CVE-2026-84869](https://nvd.nist.gov/vuln/detail/CVE-2026-84869)
6. [CISA — Known Exploited Vulnerabilities: CVE-2026-84869](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869)
7. [Huntress — Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity](https://www.huntress.com/blog/rogue-screenconnect-installations)
8. [Help Net Security — Attackers use rogue ScreenConnect clients to spread malware](https://www.helpnetsecurity.com/2026/09/07/connectwise-screenconnect-file-transfer-flaw/)
9. [BleepingComputer — CISA warns of hackers exploiting critical ScreenConnect flaw](https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/)

---
Source page: https://erroneo.us/security/briefs/connectwise-screenconnect-cve-2026-84869-guest-file-execution/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt