Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA's "Forensics Triage Requirements" (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.
NVD: A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
warncomponent_extraction: Component 'ScreenConnect client file-transfer handling in Support and Access sessions (TransferFiles permission)' matches or contains product name 'ScreenConnect' — no specific component identified
Hunting hypothesis agent
Hunt ScreenConnect audit logs for RunFiles or RanFiles entries showing script execution from Process: Guest, and hunt endpoint telemetry for ScreenConnect.WindowsClient.exe spawning wscript.exe or powershell.exe as child processes.
Research details
ComponentScreenConnect client file-transfer handling in Support and Access sessions (TransferFiles permission)
PreconditionsRequires network access to a ScreenConnect instance with an active remote session and low-privileged credentials; the TransferFiles permission must be enabled (default in all roles). No Host confirmation is required for file transfer and execution in vulnerable versions prior to 26.6.5. On-premise and cloud deployments both affected; servers themselves are not impacted. agent
DeliveryModified ScreenConnect client packages VBScript stagers into file-transfer messages with Run action, targeting newly connected Host sessions for worm-like propagation
Exploit notesLow attack complexity (CVSS AC:L). Active exploitation with worm-like propagation observed by Huntress in late August 2026. Modified ScreenConnect clients automatically transfer and execute VBScript chains (1.vbs through 4.vbs) on newly connected Host sessions without authorization. No public standalone PoC; exploitation is via modified ScreenConnect client binaries deployed through social engineering (Quick Assist, phishing).
SummaryConnectWise ScreenConnect versions prior to 26.6.5 contain a missing authorization vulnerability in client-side file-transfer handling that allows files to be transferred and executed through active remote sessions without Host confirmation. Active exploitation with worm-like propagation has been observed in the wild. Cloud instances are patched; on-premise deployments must upgrade to 26.6.5 or disable the TransferFiles permission.
Tia coverage
First reported2026-09-01
First exploit report2026-09-11
Exploit report → KEV0 days before the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.