CISA said ConnectWise ScreenConnect’s critical CVE-2026-84869 is being actively exploited, turning a long-running advisory into a confirmed in-the-wild attack path on remote-support deployments. The warning lands on day 13 of coverage and narrows the issue to how file transfer behaves inside live support sessions.
The problem is that a transferred file can run on the host during an active session without the usual approval step, so the helpdesk workflow itself can become the execution channel. In plain terms, an attacker who gets into a trusted support session may be able to use ScreenConnect to launch code on the endpoint, not just reach the ScreenConnect server.
For organizations that rely on ScreenConnect for helpdesk or endpoint management, the exposure sits in any environment where remote sessions and file transfer are part of normal operations. The patch matters, but the bigger lesson is that a live support session can outlast the fix as a trust boundary if it is already in use.
CVSS 9.9 CRITICAL: a condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. EPSS 0.9% (59th percentile).
CISA federal remediation date Sep 14 · date passed