ConnectWise ScreenConnect file-transfer flaw CVE-2026-84869 exploited; update to 26.6.5
A critical ScreenConnect flaw (CVE-2026-84869, CVSS 9.9) lets attackers push and run files in remote sessions without approval. CISA says it is being exploited. Self-hosted users should update to 26.6.5 and reinstall host clients. Cloud instances were already updated.
If you run your own ScreenConnect server, update to 26.6.5, then reinstall host clients and update access agents. If you can't update yet, remove the TransferFiles permission from every role. If your IT provider uses ScreenConnect, ask whether they are on 26.6.5 or the cloud version.
- ConnectWise ScreenConnectfixed in 26.6.5 and later
- ConnectWise ScreenConnectfixed in 26.6.5 and later
What’s happening
ConnectWise ScreenConnect, a widely used remote-support tool, has a flaw (CVE-2026-84869) in its client that can let an attacker transfer and run files during an active remote session without authorisation or the host's confirmation. ConnectWise rates it CVSS 9.9 and Priority 1, and says all versions before 26.6.5 are affected. The company says the ScreenConnect servers themselves are not affected. ConnectWise published temporary mitigations on 7 September and released the fixed version, 26.6.5, in a bulletin dated 8 September. Its cloud instances were already upgraded. Self-hosted customers must upgrade, then reinstall host clients and update access agents. CISA added the flaw to its list of exploited vulnerabilities on 11 September. The ConnectWise bulletin does not itself say the flaw is exploited, and the reporting reviewed does not name the attackers or any malware. On 16 September Shadowserver was tracking more than 1,000 unpatched internet-exposed instances. Scammers also misuse ScreenConnect against families, but that is a separate issue.
- What
- Flaw
- Affects
- ConnectWise ScreenConnect remote access software
- Affected
- ConnectWise ScreenConnect, all versions before 26.6.5
- Fixed in
- 26.6.5
- Since
- 8 Sept 2026
- Closed
- 16 Sept 2026
Timeline
- Update
Shadowserver was tracking more than 1,000 unpatched, internet-exposed ScreenConnect instances, 758 of them in North America and 180 in Europe. The attackers have not been named publicly in the coverage reviewed.
- CISA added
CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog, giving US federal agencies three days to secure their systems.
- New fixFixed
ConnectWise's bulletin released ScreenConnect 26.6.5 for CVE-2026-84869 (CVSS 9.9, Priority 1). All earlier versions are affected. Cloud instances were already upgraded; on-premises customers must upgrade and then reinstall host clients and update access agents.
- Made public
ConnectWise published temporary mitigations for the ScreenConnect flaw, advising customers to switch off the TransferFiles permission.
Sources
- ScreenConnect 26.6.5 security patch summaryConnectWise · 8 Sept 2026
- CISA warns of hackers exploiting critical ScreenConnect flawBleepingComputer · 16 Sept 2026