CISA Warns of Critical ScreenConnect Vulnerability Actively Exploited in Attacks
CISA added actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to the KEV catalog, setting a September 14 patch deadline.
CISA added CVE-2026-84869, a critical improper privilege management and missing authorization flaw (CWE-269, CWE-862) in ConnectWise ScreenConnect, to its Known Exploited Vulnerabilities Catalog on September 11, 2026, confirming active exploitation. The flaw lets attackers transfer files to a device and execute them during an active remote ScreenConnect session without authorization or host-user confirmation, enabling payload delivery, unauthorized tools, and persistence while blending into legitimate remote-management traffic. CISA set a September 14 remediation deadline under BOD 26-04 and flagged the vulnerability as requiring forensic triage. ConnectWise has published a security bulletin, and defenders are urged to review exposure, sessions, file-transfer records, and outbound connections.
- CISA confirmed active exploitation and added CVE-2026-84869 to KEV on September 11, 2026.
- Flaw allows unauthorized file transfer and execution during active ScreenConnect remote sessions.
- Mapped to CWE-269 Improper Privilege Management and CWE-862 Missing Authorization.
- BOD 26-04 remediation deadline September 14, 2026; forensic triage required beyond patching.
- RMM compromise risk is amplified because ScreenConnect often manages multiple client environments.
- CVEs
- CVE-2026-84869
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1105 Ingress Tool TransferT1219 Remote Access Software
- Vendors
- ConnectWiseCISA
- Products
- ScreenConnect
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-84869 | Missing authorization in ScreenConnect client allows unauthorized file execution | 9.9 | <1% | KEV | KEV |
From the original article
2 min read at cybersecuritynews.com
The U. S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical ConnectWise ScreenConnect vulnerability, tracked as CVE-2026-84869, to its Known Exploited Vulnerabilities (KEV) Catalog after confirming that threat actors are actively exploiting the flaw in attacks.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.