CVE-2026-84869

CriticalCVSS 9.9/10Known exploited (CISA KEV)Last modified Sep 12, 2026

Description

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-269 CWE-862

Affected software

Vendor	Product	Versions
ConnectWise	ScreenConnect	All versions prior to 26.6.5

References

https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869Third Party Advisory
https://www.connectwise.com/company/trust/advisoriesVendor Advisory
https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletinVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869US Government Resource
https://www.huntress.com/blog/rogue-screenconnect-installationsThird Party Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 12, 2026
Added to CISA KEV: Sep 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-84877.5Incorrect default permissions vulnerability in Progress Software MOVEit Automation allows Retrieve Embedded Sensitive Data. This issue affe CVE-2026-848758.8IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to execute arbitrary code due to a buffer overflow.CVE-2026-84887.5Allocation of resources without limits or throttling vulnerability in Progress Software MOVEit Automation allows Excessive Allocation. This CVE-2026-848826.5IBM Guardium Data Protection 12.2 is vulnerable to path traversal in the Universal Connector Oracle Wallet upload component. An authenticate CVE-2026-848848.8IBM Guardium Data Protection 12.2 stores internal REST service-account passwords in a reversible plaintext-equivalent format. An authenticat CVE-2026-848854.3A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the componen CVE-2026-848865.3A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_a CVE-2026-848874.3A vulnerability was identified in simular-ai Agent-S up to 0.3.2. Affected by this issue is some unknown functionality of the file grounding CVE-2026-848884.3A weakness has been identified in RightNow-AI OpenFang up to 0.6.9. This vulnerability affects the function shell_exec of the file crates/op CVE-2026-848898.8IBM Langflow OSS 1.0.0 through 1.10.3 could allow a remote authenticated attacker to execute arbitrary code due to improper limitation of a CVE-2026-84896.4The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is v CVE-2026-848905.9undici's decompress interceptor decompresses response bodies according to the untrusted Content-Encoding header. While the number of content