CISA adds actively exploited ConnectWise ScreenConnect flaw CVE-2026-84869 to KEV

What happened

CISA has added a ConnectWise ScreenConnect vulnerability, tracked as CVE-2026-84869, to its Known Exploited Vulnerabilities catalog, confirming that attackers are using it in the wild [1]. The flaw is a combination of improper privilege management and missing authorization that, according to CISA’s entry, can let an attacker transfer and execute files through an active remote session without authorisation or confirmation from the host [1].

ConnectWise published temporary mitigation guidance on 7 September, recommending that teams disable TransferFiles permissions to cut off the attack path [1]. The vulnerability is fixed in ScreenConnect 26.6.5 and later [1]. NVD data records a CVSS 3.1 base score of 9.9 with the vector AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H — network-reachable, low complexity, no user interaction, and only basic existing privileges required.

The KEV entry was added on 11 September with a remediation deadline of 14 September, giving federal agencies three days to act [1]. CISA’s required action points those agencies at ConnectWise’s instructions alongside BOD 26-04 patching guidance and forensic triage requirements, and tells stakeholders to discontinue use of the product if mitigations are not available. The KEV ransomware field is currently marked as unknown.

Who is affected

The vulnerability is in the ScreenConnect client. The published CVE description states explicitly that ScreenConnect servers are not impacted. That distinction matters for scoping: the exposure is on endpoints running the agent, not only on the management plane.

ConnectWise serves more than 100,000 IT providers, and ScreenConnect is widely deployed by managed service providers and internal IT teams for remote troubleshooting, patching and maintenance [1]. That deployment model is what makes these bugs consequential — a single compromised session can reach many downstream customer estates.

Shadowserver is tracking over 1,000 ScreenConnect instances that remain unpatched and reachable from the internet, with 758 in North America and 180 in Europe [1]. The source does not explain how that internet-exposure count maps to a client-side defect, so treat the figure as an indicator of unpatched deployments rather than a precise count of exploitable clients.

How it works

The public detail is thin, and we are not going to fill the gap with speculation. What the sources support is this: an attacker who already holds basic privileges within ScreenConnect can push a file to a machine over an active remote session and cause it to run, bypassing the authorisation check and the host-side confirmation prompt that would normally gate that action [1]. No user interaction is needed, and attack complexity is rated low.

The CVSS scope change (S:C) is consistent with the impact crossing from the ScreenConnect component into the underlying host. The sources go no further than file transfer and execution on managed endpoints, from a position many organisations treat as semi-trusted; they do not characterise what an attacker can run or with which privileges.

Neither source describes the exploitation activity in detail — no threat actor attribution, no volumes, no indicators of compromise, and no published proof-of-concept status.

Context: a recurring target

Since 2024, CISA has flagged four ScreenConnect security issues as actively exploited, and two of those four have also been abused in ransomware attacks [1]. The source does not say which two. CVE-2024-1709, an authentication bypass with a CVSS score of 10.0, was exploited in 2024 by the North Korean-linked Kimsuky group and by several ransomware crews [1].

In 2025, ConnectWise rotated code-signing certificates after disclosing that suspected state-sponsored attackers had used a ViewState code injection flaw, CVE-2025-3935, to reach cloud-hosted instances belonging to a limited number of customers [1]. More recently, ConnectWise fixed CVE-2026-3564, a cryptographic signature verification weakness in the server component that could allow server takeover; the source says this was addressed in March without stating the year [1]. CVE-2026-3564 is not in KEV.

Remote monitoring and management tooling is a standing target because it is privileged by design, broadly deployed, and often excluded from the scrutiny applied to other internet-facing software.

What to do

• Upgrade ScreenConnect clients to 26.6.5 or later. If you run the cloud-hosted product, confirm with ConnectWise which client build your agents are on rather than assuming the server-side update covers them.
• If you cannot patch immediately, disable TransferFiles permissions as ConnectWise advised on 7 September [1]. Treat this as a stopgap, not a fix.
• Inventory every place the ScreenConnect agent is installed, including customer estates if you are an MSP, and dormant or decommissioned hosts. Client-side scope means asset lists matter more than perimeter scans here.
• Review ScreenConnect session and file-transfer logs for transfers or executions that were not preceded by host confirmation, and for activity from low-privilege accounts. The sources publish no IOCs, so hunt on behaviour.
• Audit ScreenConnect user accounts and permissions. The flaw requires some level of existing privilege, so stale technician accounts, shared credentials and over-broad roles are the enabling conditions.
• Remove any ScreenConnect management interface from direct internet exposure and put it behind SSO with MFA and IP restrictions.
• Federal agencies: the KEV due date of 14 September has already passed. Apply the BOD 26-04 process, including the forensic triage requirements referenced in CISA’s action note.
• Check that you have also applied the fixes for CVE-2025-3935 and CVE-2026-3564, both of which affect the server side.