CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
At a glance
- Source
- NVD
- EPSS
- EPSS 0.92 % · percentile 60 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ConnectWise
- NVD status
- Analyzed
Description
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Weaknesses (CWE)
References
- https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
- https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869
- https://www.connectwise.com/company/trust/advisories
- https://www.huntress.com/blog/rogue-screenconnect-installations
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | ConnectWise |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · 7d616e1a-3288-43b1-a0dd-0a65d3e70a49 (Secondary) |
European references
- ENISA EUVD · EUVD-2026-74053
- GCVE · GCVE-0-2026-84869
Affected configurations (NVD CPE)
cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*< 26.6.5.9742
Affected products
| Product | Versions |
|---|---|
| ConnectWise · ScreenConnect | affected All versions prior to 26.6.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |