CVE-2026-84869

CRITICAL9.9

CISA KEV

Published 2026-09-08 · Updated 2026-09-12 · Source 7d616e1a-3288-43b1-a0dd-0a65d3e70a49

Summary

CVE-2026-84869 is a critical-severity (CVSS 9.9) vulnerability in ConnectWise ScreenConnect. CISA added it to the Known Exploited Vulnerabilities catalog on September 11, 2026, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by September 14, 2026. CISA does not currently list it as used in ransomware campaigns. ConnectWise has 4 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

All 4 known-exploited ConnectWise vulnerabilities →

Description

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE-269CWE-862

CISA Known-Exploited Vulnerability

Product: ConnectWise — ScreenConnect

Name: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

Date added: 2026-09-11 · Due: 2026-09-14

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

References

View on NVD

More exploited ConnectWise vulnerabilities

Most recently added to CISA KEV

CVE-2024-1708
RANSOMWARE
ScreenConnect — ConnectWise ScreenConnect Path Traversal Vulnerability
added 2026-04-28
CVE-2025-3935
ScreenConnect — ConnectWise ScreenConnect Improper Authentication Vulnerability
added 2025-06-02
CVE-2024-1709
RANSOMWARE
ScreenConnect — ConnectWise ScreenConnect Authentication Bypass Vulnerability
added 2024-02-22

View all →

Related CVEs

Same severity, most recent

CVE-2026-115931
Postiz lets a signed-in user ask the backend to run a function on one of their connected channels. The backend did not restrict which functions can be requested, so a user could call internal helper functions that were never meant to be reachable from the web interface. One of those helpers reads a file from the server's disk. A user who connects a channel whose stored token is a file path can have the backend return the contents of any file it can read, including its environment, which holds the secret used to sign login sessions, the database address and the credentials of connected services. Another helper makes the backend process exit with a single request. Self-registration is open by default, so no existing account and no action by another user is needed.
2026-10-23 · score 9.9
CVE-2026-115893
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19, 48.0.7, and 49.0.4, the Cranelift compiler backend on aarch64 can compile a Wasm br_table instruction with more than approximately 256,000 targets so that it has an incorrect conditional branch target. The branch can then jump to arbitrary other code at a user-controlled offset, allowing a user-controlled Wasm module to escape the sandbox on aarch64 engines using the default Cranelift backend. This issue is fixed in versions 36.0.19, 48.0.7, and 49.0.4.
2026-10-23 · score 9.9
CVE-2026-115889
Wasmtime is a runtime for WebAssembly. Prior to 36.0.19 and 43.0.0, the Cranelift compiler backend bit-packs SSA value indices in a way that can silently overflow in release builds when compiling a sufficiently large or specially crafted Wasm function with many SSA values. The overflow can make Cranelift reference incorrect IR values, causing arbitrary miscompilation, type confusion, and other attacker-controlled effects that may escape the Wasm sandbox on any architecture using the default Cranelift backend. This issue is fixed in versions 36.0.19 and 43.0.0.
2026-10-23 · score 9.9
CVE-2026-115812
Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier might allow remote actors to execute arbitrary code via a crafted model archive. Multi Model Server is end of life and no fixed version is available. Users should discontinue use of Multi Model Server and migrate to a supported model serving solution.
2026-10-23 · score 9.8
CVE-2026-55486
The Goobi viewer is a web application that allows digitised material to be displayed in a web browser. From version 25.08 to before version 26.05, the IIIF Auth 2.0 endpoints auth/login and auth/token in AuthorizationFlowResource accept an origin query parameter without validation and then (1) embed it into the Content-Security-Policy: frame-ancestors response header and (2) embed it into an HTML response body as a JavaScript single-quoted postMessage argument. Because the attacker controls both the login and token calls that initiate the flow, the unescaped value yields reflected XSS. This issue has been patched in version 26.05.
2026-10-23 · score 9.3