CVE-2026-84869 – ConnectWise ScreenConnect
“When a remote session can push and run files with no one approving them, the support tool becomes the attacker's way in.”
ConnectWise has fixed a flaw in the ScreenConnect client that lets files be transferred and executed through an active remote session without authorization or Host confirmation. The flaw comes from improper privilege management and a missing authorization check, so an attacker can gain elevated privileges on the endpoint. CVE-2026-84869 has a CVSS score of 9.9, Critical severity. ScreenConnect servers are not affected. The risk sits on the client endpoints.
Attackers are actively exploiting CVE-2026-84869. Every machine running the ScreenConnect client is exposed while it stays unpatched. Treat this update as an immediate priority across all managed endpoints.
Key Details
- Affected Product
- Connectwise Screenconnect
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-269