CRITICAL 9.9 NVD ACTIVELY EXPLOITED
CVE-2026-84869
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmati
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Affected Products
- connectwise/screenconnect
References
- https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869
- https://www.connectwise.com/company/trust/advisories
- https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bull
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869
- https://www.huntress.com/blog/rogue-screenconnect-installations
This critical severity vulnerability with a CVSS score of 9.9 was published on 2026-09-08 via NVD. ⚠ This vulnerability is in the CISA Known Exploited Vulnerabilities (KEV) catalog — it is being actively exploited in the wild. Affected: connectwise/screenconnect.
Risk Timeline
CVE Disclosed2026-09-08 · 2 days ago
CISA KEV — Actively ExploitedU.S. federal agencies required to patch · confirmed threat-actor activity
Remediation Resources
Analysis & PoC
www.connectwise.com/company/trust/advisoriesAnalysis & PoC
www.huntress.com/blog/rogue-screenconnect-installations
vulnfeed aggregates 13138 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.