ConnectWise patches critical ScreenConnect authentication failure after five days
ConnectWise patched ScreenConnect flaw CVE-2026-84869 five days after warning files could be transferred and executed via active sessions without authorization.
ConnectWise released ScreenConnect client version 26.6.5 and later to fix CVE-2026-84869, an authentication failure in ConnectWise Remote Access allowing unauthorized file transfer and execution through active remote sessions. The company warned customers on September 3 and advised admins to remove the TransferFiles permission from users with open sessions as an interim mitigation. The advisory does not state that exploitation has been observed.
66