CVE entry · CVE-2026-84869
CVE-2026-84869: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.
- Actively exploited: added to CISA’s KEV catalog on September 11, 2026.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: September 14, 2026.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes ConnectWise ScreenConnect, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (www.connectwise.com)
- NVD entry (NIST)
- CISA KEV catalog
Other ConnectWise vulnerabilities
-
CVE-2024-1708Used by ransomwareConnectWise ScreenConnect Path Traversal Vulnerability