CISA added a ConnectWise ScreenConnect vulnerability to its Known Exploited Vulnerabilities catalog on September 11, 2026, putting a familiar remote-support tool back into the risk conversation. The vulnerability, CVE-2026-84869, relates to a ScreenConnect client condition that ConnectWise says may allow files to be transferred and executed through an active remote session without authorization or host confirmation in certain circumstances.
ConnectWise released ScreenConnect 26.6.5 on September 8. The company says ScreenConnect servers are not impacted, cloud instances have been updated, and on-premises partners should upgrade affected versions prior to 26.6.5. If an immediate update is not possible, ConnectWise describes temporarily removing file-transfer permission from roles as a mitigation until the update can be applied.
Why this matters beyond the patch
Many businesses never see the ScreenConnect license, admin page, or update notice. They experience the tool through an MSP, IT provider, software vendor, or support desk that uses remote access to fix devices. That makes the business decision less about reading a CVE and more about knowing who has remote-support authority inside the company.
A remote-support platform can be perfectly legitimate and still deserve careful review. If a tool can open a session, transfer files, run utilities, or maintain access agents, owners should know where it is deployed, who administers it, and what evidence exists after a high-priority security update. Remote access works best when વિશ્વાસ comes with receipts.
The owner decision
The practical question is simple: can your provider prove that remote support access is current, limited, and reviewed?
For a New Jersey business, medical office, school, nonprofit, manufacturer, or professional services firm, that proof should not stop at a quick "we patched it" reply. The answer should include whether ScreenConnect is used, whether it is cloud or on-premises, what version is running, whether host clients and access agents were updated, and whether file-transfer permissions were checked.
Questions to ask your IT provider
- Do we use ConnectWise ScreenConnect anywhere in our environment, either directly or through a vendor?
- Are any on-premises ScreenConnect servers running versions before 26.6.5?
- Have host clients and access agents been reinstalled or updated where required?
- Who has permission to transfer files, run tools, or start unattended remote sessions?
- Were session logs, file-transfer logs, technician accounts, roles, and recent access reviewed after the update?
- If the update could not be applied immediately, were file-transfer permissions temporarily removed from affected roles?
- Is MFA required for technicians and administrators with remote-support access?
- Can the provider document the date, version, reviewer, and any unusual findings?
A practical next step
Ask for a short remote-support access review, not a long technical memo. The useful deliverable is a one-page confirmation that names the tools in use, the current version or patch status, the admins and roles with high-risk permissions, the logging that was reviewed, and the exceptions that still need an owner decision.
If your business depends on an MSP, this is also a good moment to ask how remote-access tools are approved in the first place. A provider may need them to support you quickly. The owner still deserves a clear inventory, permission model, and review trail. In this case, the control point is not just the patch window. It is the authority behind the remote session.
Sources and further reading
