Vulnerability-Lookup

CVE-2026-84869 (GCVE-0-2026-84869)

Vulnerability from cvelistv5 – Published: 2026-09-08 19:29 – Updated: 2026-09-12 03:55

Title

ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

Summary

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Severity

9.9 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: active Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-10 00:00 UTC

CWE

CWE-862 - Missing Authorization
CWE-269 - Improper Privilege Management

Assigner

ConnectWise mitre root

References

5 references

URL	Tags
https://www.connectwise.com/company/trust/securit…
https://github.com/ConnectWise-Advisories/Disclos…
https://www.connectwise.com/company/trust/advisories
https://www.huntress.com/blog/rogue-screenconnect…	third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilit…	government-resource

Impacted products

1 product

Vendor	Product	Version
ConnectWise	ScreenConnect	Affected: All versions prior to 26.6.5

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-84869",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-10T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2026-09-11",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-12T03:55:19.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "third-party-advisory"
            ],
            "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
          },
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2026-09-11T00:00:00.000Z",
            "value": "CVE-2026-84869 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "ScreenConnect",
          "vendor": "ConnectWise",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 26.6.5"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
            }
          ],
          "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-1",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T19:29:33.630Z",
        "orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "shortName": "ConnectWise"
      },
      "references": [
        {
          "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
        },
        {
          "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
        },
        {
          "url": "https://www.connectwise.com/company/trust/advisories"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cb\u003eCloud:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eUpdated to the latest release. We recommend that\npartners \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client\"\u003ereinstall their host clients\u003c/a\u003e\u003cspan\u003e and \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent\"\u003eupdate their access agents\u003c/a\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eOn-prem\u003c/b\u003e:\u0026nbsp;\u003cspan\u003eUpgrade to ScreenConnect client version \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eor later.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eAutomate-integrated ScreenConnect deployments:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eAutomate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eupdate through Automate\nProduct Updates.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Cloud:\u00a0Updated to the latest release. We recommend that\npartners  reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client  and  update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent .\n\n\n\nOn-prem:\u00a0Upgrade to ScreenConnect client version 26.6.5 or later.\n\n\n\nAutomate-integrated ScreenConnect deployments:\u00a0Automate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate\nProduct Updates."
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eIf you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. \u003cb\u003eThis is\nnot a substitute for installing the security update\u003c/b\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003eNavigate to the \u003cb\u003eAdministration \u0026gt; Security \u0026gt; Roles\u003c/b\u003e section. \u003c/li\u003e\u003cli\u003eEdit\na role, review each session group that has permissions assigned to it, and\ndeselect the \u003cb\u003eTransferFiles\u003c/b\u003e permission if it is selected.\u003c/li\u003e\u003cli\u003eSave\nyour changes. Repeat for each role.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e"
            }
          ],
          "value": "If you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. This is\nnot a substitute for installing the security update.\n\n\n\n\n\n\n\n  *  Navigate to the Administration \u003e Security \u003e Roles section. \n  *  Edit\na role, review each session group that has permissions assigned to it, and\ndeselect the TransferFiles permission if it is selected.\n  *  Save\nyour changes. Repeat for each role."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 1.0.5"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
    "assignerShortName": "ConnectWise",
    "cveId": "CVE-2026-84869",
    "datePublished": "2026-09-08T19:29:33.630Z",
    "dateReserved": "2026-09-02T13:57:51.898Z",
    "dateUpdated": "2026-09-12T03:55:19.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-84869",
      "date": "2026-10-03",
      "epss": "0.00924",
      "percentile": "0.59068"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-84869",
                    "options": [
                      {
                        "Exploitation": "active"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-09-11T18:50:39.725092Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              },
              {
                "other": {
                  "content": {
                    "dateAdded": "2026-09-11",
                    "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
                  },
                  "type": "kev"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-09-09T20:46:25.354Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "third-party-advisory"
                ],
                "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
              },
              {
                "tags": [
                  "government-resource"
                ],
                "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
              }
            ],
            "timeline": [
              {
                "lang": "en",
                "time": "2026-09-11T00:00:00.000Z",
                "value": "CVE-2026-84869 added to CISA KEV"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unaffected",
              "product": "ScreenConnect",
              "vendor": "ConnectWise",
              "versions": [
                {
                  "status": "affected",
                  "version": "All versions prior to 26.6.5"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
                }
              ],
              "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
            }
          ],
          "impacts": [
            {
              "capecId": "CAPEC-1",
              "descriptions": [
                {
                  "lang": "en",
                  "value": "CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs"
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.9,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-862",
                  "description": "CWE-862 Missing Authorization",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-269",
                  "description": "CWE-269 Improper Privilege Management",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-09-08T19:29:33.630Z",
            "orgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
            "shortName": "ConnectWise"
          },
          "references": [
            {
              "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
            },
            {
              "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
            },
            {
              "url": "https://www.connectwise.com/company/trust/advisories"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003e\u003cb\u003eCloud:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eUpdated to the latest release. We recommend that\npartners \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client\"\u003ereinstall their host clients\u003c/a\u003e\u003cspan\u003e and \u003c/span\u003e\u003ca href=\"https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent\"\u003eupdate their access agents\u003c/a\u003e\u003cspan\u003e.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eOn-prem\u003c/b\u003e:\u0026nbsp;\u003cspan\u003eUpgrade to ScreenConnect client version \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eor later.\u003c/span\u003e\u003c/p\u003e\u003cp\u003e\u003cb\u003eAutomate-integrated ScreenConnect deployments:\u0026nbsp;\u003c/b\u003e\u003cspan\u003eAutomate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect \u003c/span\u003e\u003cspan\u003e26.6.5 \u003c/span\u003e\u003cspan\u003eupdate through Automate\nProduct Updates.\u003c/span\u003e\u003c/p\u003e"
                }
              ],
              "value": "Cloud:\u00a0Updated to the latest release. We recommend that\npartners  reinstall their host clients https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_client/Reinstall_the_host_client  and  update their access agents https://docs.connectwise.com/ScreenConnect_Documentation/Get_started/Host_page/Reinstall_and_upgrade_an_access_agent .\n\n\n\nOn-prem:\u00a0Upgrade to ScreenConnect client version 26.6.5 or later.\n\n\n\nAutomate-integrated ScreenConnect deployments:\u00a0Automate partners are eligible to update their integrated\non-premises ScreenConnect installation as long as their Automate Assurance\nsubscription is active. Automate partners should apply the ScreenConnect 26.6.5 update through Automate\nProduct Updates."
            }
          ],
          "source": {
            "discovery": "UNKNOWN"
          },
          "title": "ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eIf you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. \u003cb\u003eThis is\nnot a substitute for installing the security update\u003c/b\u003e.\u003c/p\u003e\n\n\u003cp\u003e\u003c/p\u003e\u003col\u003e\u003cli\u003eNavigate to the \u003cb\u003eAdministration \u0026gt; Security \u0026gt; Roles\u003c/b\u003e section. \u003c/li\u003e\u003cli\u003eEdit\na role, review each session group that has permissions assigned to it, and\ndeselect the \u003cb\u003eTransferFiles\u003c/b\u003e permission if it is selected.\u003c/li\u003e\u003cli\u003eSave\nyour changes. Repeat for each role.\u003c/li\u003e\u003c/ol\u003e\u003cp\u003e\u003c/p\u003e"
                }
              ],
              "value": "If you are\nunable to apply the update immediately due to maintenance windows or\nchange-freeze policies, you can implement the following as a temporary\nmitigation to help reduce exposure until the update can be applied. This is\nnot a substitute for installing the security update.\n\n\n\n\n\n\n\n  *  Navigate to the Administration \u003e Security \u003e Roles section. \n  *  Edit\na role, review each session group that has permissions assigned to it, and\ndeselect the TransferFiles permission if it is selected.\n  *  Save\nyour changes. Repeat for each role."
            }
          ],
          "x_generator": {
            "engine": "Vulnogram 1.0.5"
          }
        }
      },
      "cveMetadata": {
        "assignerOrgId": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "assignerShortName": "ConnectWise",
        "cveId": "CVE-2026-84869",
        "datePublished": "2026-09-08T19:29:33.630Z",
        "dateReserved": "2026-09-02T13:57:51.898Z",
        "dateUpdated": "2026-09-12T03:55:19.450Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-84869

Vulnerability from fkie_nvd - Published: 2026-09-08 20:18 - Updated: 2026-09-12 04:16

Severity

9.9 (Critical) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Summary

References

URL	Tags
7d616e1a-3288-43b1-a0dd-0a65d3e70a49	https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869	Third Party Advisory
7d616e1a-3288-43b1-a0dd-0a65d3e70a49	https://www.connectwise.com/company/trust/advisories	Vendor Advisory
7d616e1a-3288-43b1-a0dd-0a65d3e70a49	https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869	US Government Resource
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.huntress.com/blog/rogue-screenconnect-installations	Third Party Advisory

Impacted products

	Vendor	Product	Version
	connectwise	screenconnect	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "ScreenConnect",
          "vendor": "ConnectWise",
          "versions": [
            {
              "status": "affected",
              "version": "All versions prior to 26.6.5"
            }
          ]
        }
      ],
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49"
    }
  ],
  "cisaActionDue": "2026-09-14",
  "cisaExploitAdd": "2026-09-11",
  "cisaRequiredAction": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA\u2019s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA\u2019s \u201cForensics Triage Requirements\u201d (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset\u0027s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.",
  "cisaVulnerabilityName": "ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "270783CF-B4ED-4608-A583-A9F7B80DC877",
              "versionEndExcluding": "26.6.5.9742",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted."
    }
  ],
  "id": "CVE-2026-84869",
  "lastModified": "2026-09-12T04:16:42.757",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0,
        "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-84869",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-10T00:00:00+00:00",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-08T20:18:51.147",
  "references": [
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
    },
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.connectwise.com/company/trust/advisories"
    },
    {
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
    }
  ],
  "sourceIdentifier": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        },
        {
          "lang": "en",
          "value": "CWE-862"
        }
      ],
      "source": "7d616e1a-3288-43b1-a0dd-0a65d3e70a49",
      "type": "Secondary"
    }
  ]
}

GHSA-RC8V-F46M-JCGM

Vulnerability from github – Published: 2026-09-08 21:34 – Updated: 2026-09-11 21:31

Details

Severity

9.9 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-84869"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T20:18:51Z",
    "severity": "CRITICAL"
  },
  "details": "A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.",
  "id": "GHSA-rc8v-f46m-jcgm",
  "modified": "2026-09-11T21:31:17Z",
  "published": "2026-09-08T21:34:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84869"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869"
    },
    {
      "type": "WEB",
      "url": "https://www.connectwise.com/company/trust/advisories"
    },
    {
      "type": "WEB",
      "url": "https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin"
    },
    {
      "type": "WEB",
      "url": "https://www.huntress.com/blog/rogue-screenconnect-installations"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

WID-SEC-W-2026-3256

Vulnerability from csaf_certbund - Published: 2026-09-08 22:00 - Updated: 2026-09-09 22:00

Summary

ConnectWise ScreenConnect: Schwachstelle ermöglicht Codeausführung

Severity

Hoch

Scope

1 vulnerability in this advisory, including CVE-2026-84869.

CVE-2026-84869

Known affected: 2 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-84869 (GCVE-0-2026-84869)

FKIE_CVE-2026-84869

GHSA-RC8V-F46M-JCGM

WID-SEC-W-2026-3256

Tags

Sightings

Nomenclature

Related by attack behaviour