{"id":"screenconnect-file-transfer-cve-2026-84869-sep-2026","category":"patch","status":"closed","title":"ConnectWise ScreenConnect file-transfer flaw CVE-2026-84869 exploited; update to 26.6.5","tldr":"A critical ScreenConnect flaw (CVE-2026-84869, CVSS 9.9) lets attackers push and run files in remote sessions without approval. CISA says it is being exploited. Self-hosted users should update to 26.6.5 and reinstall host clients. Cloud instances were already updated.","summary":"ConnectWise ScreenConnect, a widely used remote-support tool, has a flaw (CVE-2026-84869) in its client that can let an attacker transfer and run files during an active remote session without authorisation or the host's confirmation. ConnectWise rates it CVSS 9.9 and Priority 1, and says all versions before 26.6.5 are affected. The company says the ScreenConnect servers themselves are not affected. ConnectWise published temporary mitigations on 7 September and released the fixed version, 26.6.5, in a bulletin dated 8 September. Its cloud instances were already upgraded. Self-hosted customers must upgrade, then reinstall host clients and update access agents. CISA added the flaw to its list of exploited vulnerabilities on 11 September. The ConnectWise bulletin does not itself say the flaw is exploited, and the reporting reviewed does not name the attackers or any malware. On 16 September Shadowserver was tracking more than 1,000 unpatched internet-exposed instances. Scammers also misuse ScreenConnect against families, but that is a separate issue.","action":"If you run your own ScreenConnect server, update to 26.6.5, then reinstall host clients and update access agents. If you can't update yet, remove the TransferFiles permission from every role. If your IT provider uses ScreenConnect, ask whether they are on 26.6.5 or the cloud version.","product":"ConnectWise ScreenConnect remote access software","audience":"work","severity":"critical","patch":"patched","exploited":true,"cves":["CVE-2026-84869"],"tags":["connectwise","screenconnect","remote-access","exploited","cisa-kev","privilege-management","missing-authorization"],"affected":["ConnectWise ScreenConnect, all versions before 26.6.5"],"fixed":["26.6.5"],"matches":[{"platform":"windows","app":"ConnectWise ScreenConnect","bundle":"","fixed":"26.6.5"},{"platform":"macos","app":"ConnectWise ScreenConnect","bundle":"","fixed":"26.6.5"}],"sources":[{"kind":"advisory","title":"ScreenConnect 26.6.5 security patch summary","url":"https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin","by":"ConnectWise","date":"2026-09-08"},{"kind":"news","title":"CISA warns of hackers exploiting critical ScreenConnect flaw","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/","by":"BleepingComputer","date":"2026-09-16"}],"started":"2026-09-08","closed":"2026-09-16","created":"2026-11-03T22:08:04.053Z","updated":"2026-11-03T22:08:04.053Z","cve_notes":[{"cve":"CVE-2026-84869","name":"ScreenConnect missing authorization in file transfers","what":"A missing-authorization and improper privilege management flaw in the ScreenConnect client that may let an attacker transfer and run files during an active remote session without authorisation or the host's confirmation.","severity":"critical","cvss":9.9}],"timeline":[{"at":"2026-09-16","added":"2026-11-03T22:05:25.250Z","kind":"other","text":"Shadowserver was tracking more than 1,000 unpatched, internet-exposed ScreenConnect instances, 758 of them in North America and 180 in Europe. The attackers have not been named publicly in the coverage reviewed.","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/","by":"BleepingComputer","patch":null},{"at":"2026-09-11","added":"2026-11-03T22:05:25.250Z","kind":"cisa-added","text":"CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog, giving US federal agencies three days to secure their systems.","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/","by":"BleepingComputer","patch":null},{"at":"2026-09-08","added":"2026-11-03T22:05:25.250Z","kind":"new-fix","text":"ConnectWise's bulletin released ScreenConnect 26.6.5 for CVE-2026-84869 (CVSS 9.9, Priority 1). All earlier versions are affected. Cloud instances were already upgraded; on-premises customers must upgrade and then reinstall host clients and update access agents.","url":"https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin","by":"ConnectWise","patch":"patched"},{"at":"2026-09-07","added":"2026-11-03T22:05:25.250Z","kind":"disclosed","text":"ConnectWise published temporary mitigations for the ScreenConnect flaw, advising customers to switch off the TransferFiles permission.","url":"https://www.bleepingcomputer.com/news/security/cisa-warns-of-hackers-exploiting-critical-screenconnect-flaw/","by":"BleepingComputer","patch":null}],"url":"https://hard.fyi/live/screenconnect-file-transfer-cve-2026-84869-sep-2026/","json":"https://hard.fyi/api/live?id=screenconnect-file-transfer-cve-2026-84869-sep-2026"}