Remote Code Execution Vulnerability in ConnectWise ScreenConnect Client
CVE-2026-84869

9.9CRITICAL

Key Information:

Vendor

Connectwise
Status
Screenconnect
Vendor
CVE Published:
8 September 2026

Badges

💰 Ransomware👾 Exploit Exists🦅 CISA Reported📰 News Worthy

What is CVE-2026-84869?

CVE-2026-84869 is a significant remote code execution vulnerability found in the ConnectWise ScreenConnect Client, a software widely used for remote access and remote support services. This vulnerability allows unauthorized file transfers and executions to occur during an active remote session without obtaining the required host confirmation. This poses a serious threat to organizations, as it enables attackers to potentially manipulate systems, inject malicious software, or exfiltrate sensitive data without detection during legitimate remote access activities. The vulnerability is specific to the ScreenConnect client, while the servers themselves remain unaffected. Technical assessments suggest that the flaw could lead to substantial disruptions in operational integrity if left unaddressed.

Potential impact of CVE-2026-84869

  1. Unauthorized Access and Control: Attackers can exploit this vulnerability to gain unauthorized control over systems, which may lead to extensive data breaches and the possibility of deploying additional malicious tools.

  2. Increased Risk of Malware Deployment: The ability to execute files remotely can facilitate the distribution of malware, including ransomware, potentially crippling organizational infrastructure and leading to financial losses.

  3. Erosion of Trust and Reputation: The successful exploitation of this vulnerability could damage an organization's reputation, resulting in a loss of customer trust and possible regulatory repercussions due to the failure to protect sensitive information against cyber threats.

CISA has reported CVE-2026-84869

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-84869 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Affected Version(s)

ScreenConnect All versions prior to 26.6.5

News Articles

favicon imageBleepingComputer

Critical ScreenConnect flaw now actively exploited in attacks

Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

22 hours ago

References

https://www.connectwise.com/company/trust/security-bullet...
https://github.com/ConnectWise-Advisories/Disclosures/tre...
https://www.connectwise.com/company/trust/advisories

CVSS V3.1

Score:
9.9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • đź’°

    Used in Ransomware

  • đź“°

    First article discovered by BleepingComputer

  • đź‘ľ

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.