ScreenConnect CVE-2026-84869 Unauthorized File Execution via Client Service

Ibrahim Saud@tektrix

•updated Sep 17, 2026•1•0•8

Detects instances where the ScreenConnect ClientService process initiates a child process that is not a recognized ScreenConnect binary. It further filters for child processes created shortly after a file has been created or modified by the ScreenConnect service, which is often indicative of an adversary using the remote access tool to drop and execute malicious payloads.