{"id":"CVE-2026-84869","title":"A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances","summary":"A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.","severity":"critical","cvss":9.9,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-269","CWE-862"],"vendor":"connectwise","product":"screenconnect","affected":["screenconnect < 26.6.5.9742"],"patched":["screenconnect 26.6.5.9742"],"published":"2026-09-08","updated":"2026-09-12","sourceUpdated":"2026-09-12T04:16:42.757","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84869","references":[{"url":"https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869","label":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49"},{"url":"https://www.connectwise.com/company/trust/advisories","label":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49"},{"url":"https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin","label":"7d616e1a-3288-43b1-a0dd-0a65d3e70a49"},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://www.huntress.com/blog/rogue-screenconnect-installations","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","in-the-wild","exploit-available","kev"],"exploited":true,"exploitAvailable":true,"ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total","timestamp":"2026-09-11T18:50:39.725092Z"},"epss":0.00691,"epssPercentile":0.50979,"kev":true,"kevDateAdded":"2026-09-11","kevDueDate":"2026-09-14","kevRansomware":false,"ingestedAt":"2026-09-08T20:10:03.222Z","slug":"CVE-2026-84869","body":"## Overview\n\nA condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.\n\n## Affected\n\n- `screenconnect < 26.6.5.9742`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `screenconnect 26.6.5.9742`","depth":"hadal","depthScore":80,"depthScoreParts":{"impact":54.5,"likelihood":0.1,"exploitation":25,"ransomware":0},"changes":[{"seq":202020,"id":"CVE-2026-84869","ts":1789400044725,"field":"exploit_available","old":"false","new":"true"},{"seq":202019,"id":"CVE-2026-84869","ts":1789400044725,"field":"exploited","old":"false","new":"true"},{"seq":202018,"id":"CVE-2026-84869","ts":1789400044725,"field":"kev","old":"false","new":"true"},{"seq":200747,"id":"CVE-2026-84869","ts":1789397603194,"field":"exploit_available","old":"true","new":"false"},{"seq":200746,"id":"CVE-2026-84869","ts":1789397603194,"field":"exploited","old":"true","new":"false"},{"seq":200745,"id":"CVE-2026-84869","ts":1789397603194,"field":"kev","old":"true","new":"false"},{"seq":199442,"id":"CVE-2026-84869","ts":1789395512756,"field":"exploit_available","old":"false","new":"true"},{"seq":199441,"id":"CVE-2026-84869","ts":1789395512756,"field":"exploited","old":"false","new":"true"},{"seq":199440,"id":"CVE-2026-84869","ts":1789395512756,"field":"kev","old":"false","new":"true"},{"seq":198687,"id":"CVE-2026-84869","ts":1789392218740,"field":"exploit_available","old":"true","new":"false"},{"seq":198686,"id":"CVE-2026-84869","ts":1789392218740,"field":"exploited","old":"true","new":"false"},{"seq":198685,"id":"CVE-2026-84869","ts":1789392218740,"field":"kev","old":"true","new":"false"},{"seq":197020,"id":"CVE-2026-84869","ts":1789384289122,"field":"exploit_available","old":"false","new":"true"},{"seq":197019,"id":"CVE-2026-84869","ts":1789384289122,"field":"exploited","old":"false","new":"true"},{"seq":197018,"id":"CVE-2026-84869","ts":1789384289122,"field":"kev","old":"false","new":"true"},{"seq":196378,"id":"CVE-2026-84869","ts":1789383756290,"field":"exploit_available","old":"true","new":"false"},{"seq":196377,"id":"CVE-2026-84869","ts":1789383756290,"field":"exploited","old":"true","new":"false"},{"seq":196376,"id":"CVE-2026-84869","ts":1789383756290,"field":"kev","old":"true","new":"false"},{"seq":195306,"id":"CVE-2026-84869","ts":1789380568463,"field":"exploit_available","old":"false","new":"true"},{"seq":195305,"id":"CVE-2026-84869","ts":1789380568463,"field":"exploited","old":"false","new":"true"},{"seq":195304,"id":"CVE-2026-84869","ts":1789380568463,"field":"kev","old":"false","new":"true"},{"seq":194149,"id":"CVE-2026-84869","ts":1789378758301,"field":"exploit_available","old":"true","new":"false"},{"seq":194148,"id":"CVE-2026-84869","ts":1789378758301,"field":"exploited","old":"true","new":"false"},{"seq":194147,"id":"CVE-2026-84869","ts":1789378758301,"field":"kev","old":"true","new":"false"},{"seq":192936,"id":"CVE-2026-84869","ts":1789376506679,"field":"exploit_available","old":"false","new":"true"},{"seq":192935,"id":"CVE-2026-84869","ts":1789376506679,"field":"exploited","old":"false","new":"true"},{"seq":192934,"id":"CVE-2026-84869","ts":1789376506679,"field":"kev","old":"false","new":"true"},{"seq":191723,"id":"CVE-2026-84869","ts":1789373610554,"field":"exploit_available","old":"true","new":"false"},{"seq":191722,"id":"CVE-2026-84869","ts":1789373610554,"field":"exploited","old":"true","new":"false"},{"seq":191721,"id":"CVE-2026-84869","ts":1789373610554,"field":"kev","old":"true","new":"false"},{"seq":190508,"id":"CVE-2026-84869","ts":1789369463615,"field":"exploit_available","old":"false","new":"true"},{"seq":190507,"id":"CVE-2026-84869","ts":1789369463615,"field":"exploited","old":"false","new":"true"},{"seq":190506,"id":"CVE-2026-84869","ts":1789369463615,"field":"kev","old":"false","new":"true"},{"seq":189295,"id":"CVE-2026-84869","ts":1789368389220,"field":"exploit_available","old":"true","new":"false"},{"seq":189294,"id":"CVE-2026-84869","ts":1789368389220,"field":"exploited","old":"true","new":"false"},{"seq":189293,"id":"CVE-2026-84869","ts":1789368389220,"field":"kev","old":"true","new":"false"},{"seq":188078,"id":"CVE-2026-84869","ts":1789365227144,"field":"exploit_available","old":"false","new":"true"},{"seq":188077,"id":"CVE-2026-84869","ts":1789365227144,"field":"exploited","old":"false","new":"true"},{"seq":188076,"id":"CVE-2026-84869","ts":1789365227144,"field":"kev","old":"false","new":"true"},{"seq":186865,"id":"CVE-2026-84869","ts":1789363466483,"field":"exploit_available","old":"true","new":"false"},{"seq":186864,"id":"CVE-2026-84869","ts":1789363466483,"field":"exploited","old":"true","new":"false"},{"seq":186863,"id":"CVE-2026-84869","ts":1789363466483,"field":"kev","old":"true","new":"false"},{"seq":185651,"id":"CVE-2026-84869","ts":1789361214848,"field":"exploit_available","old":"false","new":"true"},{"seq":185650,"id":"CVE-2026-84869","ts":1789361214848,"field":"exploited","old":"false","new":"true"},{"seq":185649,"id":"CVE-2026-84869","ts":1789361214848,"field":"kev","old":"false","new":"true"},{"seq":184438,"id":"CVE-2026-84869","ts":1789358341599,"field":"exploit_available","old":"true","new":"false"},{"seq":184437,"id":"CVE-2026-84869","ts":1789358341599,"field":"exploited","old":"true","new":"false"},{"seq":184436,"id":"CVE-2026-84869","ts":1789358341599,"field":"kev","old":"true","new":"false"},{"seq":182689,"id":"CVE-2026-84869","ts":1789354313159,"field":"exploit_available","old":"false","new":"true"},{"seq":182688,"id":"CVE-2026-84869","ts":1789354313159,"field":"exploited","old":"false","new":"true"}]}