CVE-2026-84869: CWE-862 Missing Authorization in ConnectWise ScreenConnect

This vulnerability (CVE-2026-84869) involves a missing authorization check (CWE-862) in the ScreenConnect client software by ConnectWise. Under certain conditions, an attacker with limited privileges can transfer and execute files through an active remote session without requiring explicit authorization or confirmation from the host. The flaw does not affect the ScreenConnect server component. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an attacker to transfer and execute arbitrary files on the client system during an active remote session without host authorization or confirmation. This can lead to full compromise of the affected client machine, including data theft, system manipulation, and denial of service. The server component is not affected, limiting the scope to client-side risk.

No patch or official remediation information is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should exercise caution when using the ScreenConnect client and restrict remote session access to trusted parties only.