Critical Remote‑Access Flaw in ConnectWise ScreenConnect (CVE‑2026‑84869) Actively Exploited
What Happened — A critical‑severity vulnerability (CVE‑2026‑84869) in ConnectWise ScreenConnect allows an attacker with a low‑privilege account to transfer or execute files over an active remote session without proper authorization. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed the flaw is being exploited in the wild and ordered federal agencies to remediate within three days.
Why It Matters for Trust & Control Assurance
- The issue is a classic missing‑authorization failure, directly testing the control objective of proper access‑control and privilege management that underpins many frameworks (e.g., NIST CSF 2.0, ISO 27001).
- Continuous control‑assurance programs must be able to detect and evidence that privileged actions (file transfer, execution) are only performed after explicit, logged authorization.
- Verisq’s Access‑Controls capability provides real‑time monitoring and immutable audit trails for remote‑session activities, helping organizations prove that the “no‑unauthorized‑execution” control is enforced.
Who Is Affected — Managed Service Providers (MSPs), IT departments, and any organization that relies on ScreenConnect for remote troubleshooting, patching, or system maintenance.
Recommended Actions
- Deploy ScreenConnect 26.6.5 or later immediately.
- As a temporary mitigation, disable the TransferFiles permission on all instances.
- Review remote‑session logs for any unauthorized file‑transfer or execution events since the vulnerability’s disclosure.
- Integrate continuous monitoring of privileged remote‑session actions into your audit‑readiness workflow.
Technical Notes
- Attack vector: exploitation of an improper privilege‑management and missing‑authorization flaw; no user interaction required.
- CVE: 2026‑84869 (CVSS 9.8 Critical). Patched in ScreenConnect 26.6.5+.
- Scope: Over 1,000 publicly‑exposed ScreenConnect instances remain unpatched, primarily in North America and Europe.
Source: BleepingComputer