CVE-2026-84869 describes a condition in the ScreenConnect client software where files can be transferred and executed through an active remote session without authorization or host confirmation in specific circumstances. The vulnerability is limited to the client component; ScreenConnect servers are not impacted. The CVSS 3.1 base score is 9.9, indicating a critical severity with network attack vector, low attack complexity, requiring low privileges but no user interaction, and resulting in high confidentiality, integrity, and availability impacts.

An attacker with low privileges on the ScreenConnect client can transfer and execute files without host approval during an active remote session, potentially leading to full compromise of the affected system. This could result in unauthorized code execution, data compromise, and system disruption. The server component is not affected, limiting the scope to client-side deployments.

No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict client access and monitor remote session activities carefully to mitigate risk.