ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
ConnectWise ScreenConnect allows file transfer and execution through active remote sessions without authorization. CVSS 9.9 critical, CISA KEV due September 14.
- Vendor
- ConnectWise
- Product
- ScreenConnect
- CVSS
- 9.9
- EPSS (exploit probability)
- 0.9%
- Status
- kev
- CISA patch-by (BOD 22-01)
- Published
Is CVE-2026-84869 being exploited?
Yes. CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.
FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 0.9% (scored October 14, 2026).
- CISA KEV[ LISTED ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-11-05. Full cross-catalog view: /kev-comparison
CVE-2026-84869 timeline
Every event links to its source. Catalog dates are each catalog's own; day offsets count from NVD publication. Data: JSON
What to do
US federal civilian agencies must remediate by (3 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.
An attacker with access to an active ConnectWise ScreenConnect remote session can transfer and execute files on the host without additional authorization or host confirmation. The flaw combines improper privilege management with a missing authorization check.
CISA confirmed active exploitation and added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on September 11, 2026. Federal agencies must remediate by September 14, 2026. ConnectWise’s security bulletin and the NVD entry have patch details. Any internet-exposed ScreenConnect instance should be patched now.
Other ConnectWise ScreenConnect CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2024-1708 ConnectWise ScreenConnect Path Traversal Vulnerabilityransomware use | [ HIGH ] | 8.4 | 95.4% | |
| CVE-2025-3935 ConnectWise ScreenConnect Improper Authentication Vulnerability | [ HIGH ] | 8.1 | 3.6% | |
| CVE-2024-1709 ConnectWise ScreenConnect Authentication Bypass Vulnerabilityransomware use | [ CRITICAL ] | 10.0 | 100.0% |
- Jade Sleet Hits Indian IT Firm with Custom Backdoors
- CVE-2026-94185: nvm Alias Path Traversal, Update Now
- REDCap Patches CVSS 9.8 Unauth RCE via Survey Route
- Icinga 2 Patches CVSS 9.8 Auth Bypass and Stack Overflow
- Mattermost CVE-2026-14344: Board Permission Check Skipped
- ScreenConnect Worm Attacks: CVE-2026-84869 Now Patched