Fixing and finding

[Jump to remediation plan](#remediation)

CVE ID

# CVE-2026-84869

Published 2026-09-08

Updated last month

Vendor/s

ConnectWise

Product/s

ScreenConnect

Version/s

\* > 26.6.5.9742

KEV Status

Active Exploitation

Listed in CISA's Known Exploited Vulnerabilities catalog. Active exploitation observed in the wild.

CVSS Score (v3.1)

9.9

/ 10

Critical

Severity Details

Base score

9.9 Critical

Attack vector

Network

Attack complexity

Low

Privileges required

Low

User interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Table of Contents

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

[Description ](#description)[Why this matters ](#why-this-matters)[CPE ](#cpe)[Related weakness (CWE) ](#cwe)[Remediation plan ](#remediation)[Detection Guidance ](#detection-guidance)[References ](#references)[Sources](#sources)

## Description

CVE-2026-84869 is a critical (9.9) vulnerability in ConnectWise ScreenConnect allowing unauthorized file execution. Affects versions before 26.6.5.9742.

## Why this matters

"CVE-2026-84869 is a critical vulnerability in the ConnectWise ScreenConnect client, carrying a near-maximum CVSS score of 9.9. This flaw allows unauthorized file transfers and execution during active remote sessions without the host's consent. Its inclusion in CISA’s Known Exploited Vulnerabilities (KEV) catalog indicates active exploitation in the wild, making it a high-priority threat for security teams. Because ScreenConnect is widely used for remote support, successful exploitation could lead to full system compromise and lateral movement within a network. Organizations must act immediately to secure client installations, as the vulnerability bypasses standard authorization controls."

## CPE

ConnectWise

| Product       | Version Start | Version End (excl.) | Status     |
| ------------- | ------------- | ------------------- | ---------- |
| screenconnect | \*            | 26.6.5.9742         | vulnerable |

## Related weakness (CWE)

CWE-269, CWE-862

## Remediation plan

1

### Apply official patches

Download and install the latest security updates from the ConnectWise Trust Center. Ensure all ScreenConnect client instances are updated to version 26.6.5.9742 or later to address the underlying authorization bypass flaw.

2

### Update affected systems

Identify all endpoints running ScreenConnect versions prior to 26.6.5.9742. Prioritize updates for systems with direct internet exposure or those used for critical administrative remote support tasks to minimize the attack surface.

3

### Restrict access

Implement network-level restrictions to limit ScreenConnect traffic to known, trusted IP addresses. Use firewall rules or VPNs to ensure that remote sessions can only be initiated from authorized management consoles and authenticated users.

4

### Monitor for exploitation

Audit ScreenConnect session logs for unusual file transfer activity or execution commands that lack corresponding host approval. Watch for unauthorized child processes spawned by the ScreenConnect client service, such as cmd.exe or PowerShell.

## Detection Guidance

"To detect potential exploitation, monitor ScreenConnect logs for file transfer events initiated without host confirmation. Look for suspicious child processes originating from the ScreenConnect client executable. Network-side, inspect traffic for unusual data exfiltration patterns or unauthorized remote execution commands. Review CISA’s Forensics Triage Requirements to identify specific artifacts left behind by attackers exploiting this unauthorized file execution vulnerability in your environment."

## References

[https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869 Third Party Advisory ](https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869)[https://www.connectwise.com/company/trust/advisories Vendor Advisory ](https://www.connectwise.com/company/trust/advisories)[https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin Vendor Advisory ](https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin)[https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2026-84869 US Government Resource ](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869)[https://www.huntress.com/blog/rogue-screenconnect-installations Third Party Advisory](https://www.huntress.com/blog/rogue-screenconnect-installations)

## Sources

NIST National Vulnerability Database (NVD)

CISA Known Exploited Vulnerabilities (KEV)

Experience superior visibility and a simpler approach to cyber risk management

[Get a demo](https://www.upguard.com/contact-sales)

[Free trial](https://www.upguard.com/demo)