Summary
| Parameter | Value |
|---|---|
| CVE ID | CVE-2026-84869 |
| Alert Source | CISA KEV - Active Exploitation |
| CVE Publication Year | 2026 |
| Date Published | 2026-09-11 |
| Vendor | ConnectWise |
| Product | ScreenConnect |
| CVSS Score | 9.9 (critical) |
| EPSS Score | 0.7% (percentile: 51%) |
| CISA KEV | Yes - confirmed active exploitation |
| Ransomware | Not confirmed |
| Remediation Deadline | 2026-09-14 |
Vulnerability Description
Source: CISA KEV
ConnectWise ScreenConnect contains two co-occurring flaws: improper privilege management and missing authorization.
Together they may allow an attacker to transfer and execute files through an active remote session — without authorization and without host confirmation. Both of the barriers that normally underpin trust in a remote support tool therefore fall away: operator privilege control, and the user’s informed consent to a file transfer.
The precondition is key: an active remote session is required. That limits the reach — this is not a standalone internet-facing entry vector — but it also shows where the risk sits. Remote access tools of this class are used by IT support providers to service many organisations at once, so a compromise on the operator’s side translates into the ability to run code at their customers. It is a familiar pattern in which a trusted administrative tool becomes a distribution path.
Required Actions
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 (“Prioritizing Security Updates Based on Risk”) guidance and CISA’s “Forensics Triage Requirements”. For cloud services, follow the applicable BOD 26-04 guidance; if mitigations are unavailable, discontinue use of the product.
Evaluating each asset’s internet exposure and adhering to BOD 26-04 patching guidelines remain the organisation’s responsibility.
Who Is Affected?
This vulnerability affects organisations running ConnectWise ScreenConnect — both those hosting their own instance and those whose external IT support provider uses it.
The second case is easy to miss during inventory, because the software does not appear in the organisation’s system register — yet its agent runs on the organisation’s workstations. If you rely on external support, ask the provider directly about their ScreenConnect version and the date the fix was applied.
Sources
Need help securing your systems? nFlo team offers vulnerability management and 24/7 SOC services. Contact us.
