A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Is CVE-2026-84869 exploited?
Listed in the CISA KEV catalog on 2026-09-11.
Federal remediation due 2026-09-14.
Past that date by 45 days.
EPSS puts exploitation in the next 30 days at 1%.
Public exploit code: none found in monitored sources.
Which products and versions are affected?
ConnectWise · ScreenConnect · All versions prior to 26.6.5
Is there a patch?
ConnectWise's record doesn't name a fixed version.