The short version
Remote support software lets IT providers and internal IT teams take control of a computer to fix it. On September 11, 2026, CISA added CVE-2026-84869, a flaw in one widely used remote support tool, to its Known Exploited Vulnerabilities catalog. CISA describes it as an improper privilege management and missing authorization flaw that “may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.” If remote support software is installed on your computers, whether you put it there or a past vendor did, find out which tool it is and whether it’s on a fixed version.
Why this one matters for small businesses
Remote access tools are trusted by design: they’re allowed through your security and can run programs on your machines. That makes them attractive to attackers, and it’s also why forgotten installs are a risk. Many businesses have remote tools left behind by a previous IT company, a software vendor or a one-time support call.
What to do now
- Inventory remote access tools on every computer and server.
- Check each tool against the NVD entry for CVE-2026-84869 and the vendor bulletin linked from it. The flaw is in the client software that runs on your computers; the vendor says servers aren’t impacted. Every version before the fixed release is affected.
- If you run the affected tool in the vendor’s cloud, the vendor has already upgraded the cloud instances, but you still need to reinstall host clients and update access agents. If you host it yourself, upgrade the server, then reinstall host clients and update access agents. If you can’t patch right away, the vendor’s temporary mitigation is to remove the file-transfer permission from every role.
- If your IT provider supports you with a remote tool, ask them which one, and to confirm it’s patched and the clients were reinstalled.
- Remove tools nobody actively uses, especially ones left by former vendors.
- Require MFA on remote support accounts and limit who can start sessions.
- Review recent session logs for sessions or file transfers you can’t explain.
How Queen City IT Professionals can help
If you don’t know what remote access software is on your devices, start with a free IT & security assessment. Learn more on our cybersecurity page and our managed IT page.
Frequently asked questions
What is CVE-2026-84869?
An improper privilege management and missing authorization vulnerability in a widely used remote support tool that may let an attacker transfer and execute files through an active remote session without authorization or host confirmation. CISA added it to the KEV catalog on September 11, 2026.
How do I know if remote support software is on my computers?
Look through installed programs for remote support or remote access clients, or ask your IT provider for a remote-tool inventory.
Our IT provider uses a remote support tool. Should we worry?
Ask them which tool they use, to confirm it’s on a fixed version, that host clients were reinstalled and access agents updated, and that MFA is required for technician accounts.
Should we uninstall remote access tools?
Remove any that aren’t actively used or that were installed by vendors you no longer work with. Keep only the tools your current IT team manages and monitors.