CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
| CWE | CWE-862 CWE-269 |
| Vendor | connectwise |
| Product | screenconnect |
| Published | Sep 8, 2026 |
| Last Updated | Sep 12, 2026 |
⚠️ Actively Exploited — Act Now
Get instant alerts for connectwise screenconnect
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2026-84869.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
ConnectWise / ScreenConnect
All versions prior to 26.6.5
References
connectwise.com: https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin github.com: https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869 connectwise.com: https://www.connectwise.com/company/trust/advisories huntress.com: https://www.huntress.com/blog/rogue-screenconnect-installations cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869