CVE-2026-84869

CRITICAL

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

CVSS v3.1 Score

9.9
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack Vector
NETWORK
Complexity
LOW
Privileges
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
Published: 9/8/2026Modified: 9/12/2026

Related Intelligence (2)

CRITICALZero Day

ConnectWise patches critical ScreenConnect authentication failure after five days

ConnectWise has issued a security update for ScreenConnect, five days after warning customers the product could allow files to be transferred and executed through active remote sessions without authorization or confirmation. The company warned customers on Sept. 3 of the problem with support and access sessions in ConnectWise Remote Access, advising admins to log in and remove the “TransferFiles”

CVE-2026-84869
CSO Online
HIGHVulnerability

CISA KEV: ConnectWise ScreenConnect — ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.

CVE-2026-84869ConnectWise ScreenConnect
CISA KEV

References (5)

https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869Third Party Advisoryhttps://www.connectwise.com/company/trust/advisoriesVendor Advisoryhttps://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletinVendor Advisoryhttps://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869US Government Resourcehttps://www.huntress.com/blog/rogue-screenconnect-installationsThird Party Advisory