CVE-2026-84869: ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ScreenConnect clientto a version that resolves this vulnerability.Fixed in 26.6.5 - Operational
For Automate-integrated ScreenConnect deployments on-prem, reinstall ScreenConnect host clients and update ScreenConnect access agents (reinstall/upgrade host client and reinstall/upgrade an access agent) as part of applying the ScreenConnect client update, per the referenced ScreenConnect documentation.
Event History
Frequently Asked Questions
Are ScreenConnect servers affected?
No. The issue affects the ScreenConnect client; ScreenConnect servers are not impacted.
What access does an attacker need to exploit this issue?
An attacker needs access as a guest in an active remote session. The vulnerability involves file-transfer actions that can transfer and execute files on the host without authorization or host confirmation in certain circumstances.
Does exploitation require the host user to approve the file or interact with a prompt?
No host confirmation is required in the affected circumstances described. The attack vector is network-based and does not require user interaction.