CVE-2026-84869KEV · OVERDUECWE-269CWE-862broken-access-controlprivilege-escalation

ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

Critical · published September 9, 2026

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 9.9. It is confirmed in active exploitation. It sits in the 60.1th percentile for exploit probability.

40
days past CISA
deadline
CVSS v3.1
9.9
EPSS
1%
Percentile
60.1
In the wild
Confirmed
What it is

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00924 · 60.1th percentile
Weaknesses
CWE-269 · Improper Privilege Management; CWE-862 · Missing Authorization
Published
2026-09-09T00:18Z
KEV added
2026-09-11 · due 2026-09-14
Affected products (1)
ProductVersionsFixed in
connectwise/screenconnect< 26.6.5.974226.6.5.9742
References (5)
https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869 · 7d616e1a-3288-43b1-a0dd-0a65d3e70a49https://www.connectwise.com/company/trust/advisories · 7d616e1a-3288-43b1-a0dd-0a65d3e70a49https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin · 7d616e1a-3288-43b1-a0dd-0a65d3e70a49https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869 · 134c704f-9b21-4f2e-91b3-4a467353bcc0https://www.huntress.com/blog/rogue-screenconnect-installations · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 SEP 03:18Z
    EPSS moved — → 0%
    epss
  • 08 SEP 19:29Z
    ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
    cvelistv5