CVE-2026-84869: connectwise screenconnect

CVSS 9.9 (critical) · listed as exploited by CISA since 2026-09-11 · published 2026-09-08

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Affected products (NVD): connectwise screenconnect

Fixed in (NVD): 26.6.5.9742

Weakness: CWE-269, CWE-862

Source: NVD CVE-2026-84869

References

• https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869
• https://www.connectwise.com/company/trust/advisories
• https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869
• https://www.huntress.com/blog/rogue-screenconnect-installations

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.