A flaw in ScreenConnect client software lets an attacker inside an active remote support session push files to the host and run them without the usual confirmation prompt.