Paper/Archive/CVE-2026-84869

CVE-2026-84869

ConnectWise ScreenConnect — ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

KEV · due 14 Sep EPSS 0.9%public exploit SSVC act CVSS 9.9

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 In CISA KEV+3030.0 EPSS percentile 60.3.603 × 2012.1 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Affected

ProductAffectedFixed inSource

ScreenConnectAll versions prior to 26.6.5–CNA

Scores by source

ConnectWise (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refgithub.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869 refconnectwise.com/company/trust/advisories refconnectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin writeuphuntress.com/blog/rogue-screenconnect-installations refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869 kevcisa.gov/known-exploited-vulnerabilities-catalog