CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
En bref
- Source
- NVD
- EPSS
- EPSS 0.92 % · centile 60 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- ConnectWise
- Statut NVD
- Analyzed
Description
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Faiblesses (CWE)
Références
- https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin
- https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869
- https://www.connectwise.com/company/trust/advisories
- https://www.huntress.com/blog/rogue-screenconnect-installations
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | ConnectWise |
| CVSS 3.1 | CRITICAL 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H | NVD · 7d616e1a-3288-43b1-a0dd-0a65d3e70a49 (Secondary) |
Références européennes
- ENISA EUVD · EUVD-2026-74053
- GCVE · GCVE-0-2026-84869
Configurations affectées (CPE NVD)
cpe:2.3:a:connectwise:screenconnect:*:*:*:*:*:*:*:*< 26.6.5.9742
Produits affectés
| Produit | Versions |
|---|---|
| ConnectWise · ScreenConnect | affected All versions prior to 26.6.5 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| CISA Known Exploited Vulnerabilities | CC0 1.0 |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |