ScreenConnect File Write Without User Confirmation (CVE-2026-84869)

Ibrahim Saud@tektrix

•updated Sep 17, 2026•3•0•4

Detects file creation, modification, or renaming events initiated by ScreenConnect (ClientService.exe or WindowsClient.exe) that are not accompanied by associated user confirmation, consent, or file transfer events. This can indicate an unauthorized or silent file manipulation by a remote actor using the ScreenConnect tool.