Critical severity9.9CISA KEVNVD Advisory· Published Sep 8, 2026· Updated Sep 12, 2026
CVE-2026-84869
CVE-2026-84869
Description
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*range: <26.6.5.9742
Patches
Vulnerability mechanics
References
5- github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869nvdThird Party Advisory
- www.connectwise.com/company/trust/advisoriesnvdVendor Advisory
- www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletinnvdVendor Advisory
- www.huntress.com/blog/rogue-screenconnect-installationsnvdThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource
News mentions
4- CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in AttacksCyber Security News · Sep 16, 2026
- ConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like AttacksSecurityWeek · Sep 14, 2026
- CISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVThe Hacker News · Sep 12, 2026
- CISA Adds Three Known Exploited Vulnerabilities to CatalogCISA Alerts