Small Town Sysadmin
Free CJIS checklist

Useful tools

Security alert

Update ConnectWise ScreenConnect to 26.6.5: an exploited flaw lets files run on remote PCs

CISA added a ScreenConnect client flaw to its exploited list on September 11. Cloud instances are updated, but on-premises servers need 26.6.5 and every host client needs reinstalling.

If you or your IT company uses ConnectWise ScreenConnect for remote support, make sure it’s on version 26.6.5 or later. A flaw in the ScreenConnect client can let files be transferred and run on a connected computer during an active remote session, without authorization or the host’s confirmation. CISA added it to its Known Exploited Vulnerabilities catalog on September 11, 2026.

Remote-support tools are a favorite target because one compromised tool can reach every computer it manages.

The details

  • CVE: CVE-2026-84869 (CVSS 9.9, missing authorization and improper privilege management)
  • Affected: ScreenConnect versions before 26.6.5
  • Not affected: ScreenConnect servers themselves. The flaw is in the client.
  • ConnectWise’s rating: Priority 1 (High), meaning “install as an emergency change, within days”

What to do

If you use ScreenConnect Cloud: ConnectWise has already updated cloud instances to 26.6.5. You still need to reinstall your host clients and update your access agents, per ConnectWise’s bulletin.

If you run ScreenConnect on-premises:

  1. Upgrade the server to 26.6.5. You must already be on version 25.4 or later to upgrade directly. Check Administration > Overview for your current version and your license’s “Latest Eligible Version.”
  2. Reinstall your host clients and update your access agents after upgrading. This step is easy to miss, and the flaw is in the client.
  3. Out of maintenance? Your license has to be renewed before you can install 26.6.5.

Can’t upgrade yet? As a temporary measure, ConnectWise recommends removing the TransferFiles permission from every role: go to Administration > Security > Roles, edit each role, and uncheck TransferFiles in every session group. It reduces exposure; it doesn’t replace the update.

After patching

ConnectWise recommends reviewing everyone with access: remove users you don’t recognize, check roles and permissions, change passwords, and turn on MFA. If you suspect a compromise, isolate the server, keep copies for investigation, and rebuild before bringing it back online.

Sources

All articles