- Critical 9.9
- Known exploited (CISA KEV)
CVE-2026-84869
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Scores
The facts
- Published
- 8 September 2026
- Last changed
- 12 September 2026
- NVD status
- Analyzed
- Severity
- Critical, CVSS 9.9 out of 10 (version 3.1)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- Affects
- connectwise screenconnect
- Known exploited
- Yes. CISA added it to the Known Exploited Vulnerabilities catalogue on 11 September 2026.
- EPSS
- 0.9% chance of exploitation activity in the next 30 days (percentile 60).
Is there a Securelyn advisory?
Not yet. Securelyn writes plain-English advisories for the flaws that matter most to businesses. Subscribe to the digest to hear about them.