Critical ScreenConnect flaw now actively exploited in attacks
CISA confirms active exploitation of critical ConnectWise ScreenConnect flaw CVE-2026-84869, ordering federal agencies to mitigate within three days.
ConnectWise's ScreenConnect flaw CVE-2026-84869, an improper privilege management and missing authorization bug, lets attackers with basic privileges transfer or execute files through active remote sessions in low-complexity attacks without user interaction. It is patched in ScreenConnect 26.6.5; CISA added it to the KEV catalog and ordered US federal agencies to secure systems within three days. Shadowserver tracks over 1,000 unpatched exposed instances, mostly in North America (758) and Europe (180). This is the fourth actively exploited ScreenConnect flaw since 2024; earlier issues were abused by Kimsuky and ransomware gangs.
- CVE-2026-84869 allows unauthorized file transfer and execution without user interaction
- Patched in ScreenConnect 26.6.5; mitigation disables TransferFiles permissions
- CISA KEV addition with three-day deadline for federal agencies
- Over 1,000 unpatched instances exposed, mostly in North America
- Prior ScreenConnect flaws exploited by Kimsuky and ransomware gangs
- Vendors
- ConnectWise
- Products
- ScreenConnect
- Threat actors
- Kimsuky
- Organizations
- CISAShadowserver
- Countries
- North Korea
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-1709 | Authentication Bypass in ConnectWise ScreenConnect Creates Rogue Admin Accounts | 10.0 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-3935 | ViewState Code Injection in ConnectWise ScreenConnect May Lead to RCE | 7.2 | 4% | KEV | KEV |
| CVE-2026-3564 | A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain… | 9.0 | <1% | ||
| CVE-2026-84869 | Missing authorization in ScreenConnect client allows unauthorized file execution | 9.9 | <1% | KEV | KEV |
From the original article
2 min read at bleepingcomputer.com
Attackers now exploit a critical-severity ConnectWise ScreenConnect vulnerability in the wild, according to the U. S. Cybersecurity and Infrastructure Security Agency (CISA).
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.