CVE-2026-84869

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

CVSS v3 9.9 CRITICAL

9.9^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.1 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869	Third Party Advisory
https://www.connectwise.com/company/trust/advisories	Vendor Advisory
https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin	Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869	US Government Resource
https://www.huntress.com/blog/rogue-screenconnect-installations	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-09-08 20:18

Updated : 2026-09-12 04:16

NVD link : CVE-2026-84869

Mitre link : CVE-2026-84869

CVE.ORG link : CVE-2026-84869

JSON object : View

Products Affected

connectwise

screenconnect

CWE

CWE-269

Improper Privilege Management

CWE-862

Missing Authorization

{"id": "CVE-2026-84869", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-84869", "role": "CISA Coordinator", "options": [{"exploitation": "active"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-09-10T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.9, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 3.1}]}, "affected": [{"source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "affectedData": [{"vendor": "ConnectWise", "product": "ScreenConnect", "versions": [{"status": "affected", "version": "All versions prior to 26.6.5"}], "defaultStatus": "unaffected"}]}], "published": "2026-09-08T20:18:51.147", "references": [{"url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869", "tags": ["Third Party Advisory"], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}, {"url": "https://www.connectwise.com/company/trust/advisories", "tags": ["Vendor Advisory"], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}, {"url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin", "tags": ["Vendor Advisory"], "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"}, {"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869", "tags": ["US Government Resource"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}, {"url": "https://www.huntress.com/blog/rogue-screenconnect-installations", "tags": ["Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "description": [{"lang": "en", "value": "CWE-269"}, {"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."}], "lastModified": "2026-09-12T04:16:42.757", "cisaActionDue": "2026-09-14", "cisaExploitAdd": "2026-09-11", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "270783CF-B4ED-4608-A583-A9F7B80DC877", "versionEndExcluding": "26.6.5.9742"}], "operator": "OR"}]}], "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49", "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "cisaVulnerabilityName": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability"}