CVE-2026-84869: ConnectWise ScreenConnect Privilege and Authorization Flaw Added to CISA KEV
CISA added CVE-2026-84869, a critical ConnectWise ScreenConnect improper privilege management and missing authorization flaw, to the KEV catalog on 2026-09-11 with a due date of 2026-09-14. Patch or mitigate ScreenConnect clients today.
CVE-2026-84869: ConnectWise ScreenConnect Privilege and Authorization Flaw Added to CISA KEV
TL;DR
CISA added CVE-2026-84869, an improper privilege management and missing authorization vulnerability in ConnectWise ScreenConnect, to the Known Exploited Vulnerabilities catalog on 2026-09-11 with a federal remediation due date of 2026-09-14. Treat this as an urgent remote-support tooling risk: inventory ScreenConnect clients, apply the vendor's mitigations per the ConnectWise security bulletin, and verify that unauthorized file transfer and execution through active remote sessions is no longer possible.
What this is
CVE-2026-84869 is a ConnectWise ScreenConnect improper privilege management and missing authorization vulnerability. It is tracked under CWE-269 (Improper Privilege Management) and CWE-862 (Missing Authorization). CISA added it to the Known Exploited Vulnerabilities catalog on 2026-09-11, with a federal remediation due date of 2026-09-14. Watchstack reports a CVSS score of 9.9 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, and an EPSS of 0.00691 at the 0.51195 percentile. CISA's KEV entry lists known ransomware use as Unknown.
Per the official summary, a condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted. CISA's required action is to apply mitigations in accordance with vendor instructions, consistent with BOD 26-04 and the associated Forensics Triage Requirements, and to evaluate each asset's internet exposure.
Why it matters
KEV status is the highest-priority trigger available: it means exploitation is confirmed in the wild and carries a binding remediation due date for federal agencies. For CVE-2026-84869 that window is extremely short — added 2026-09-11, due 2026-09-14 — so it should be scheduled immediately and treated as exploited. The CVSS score of 9.9 CRITICAL justifies emergency change windows and executive escalation, not deprioritization. The low EPSS of 0.00691 does not override KEV; exploitation is already confirmed, so EPSS should not be used to defer patching. Because the flaw sits in remote-support tooling that is frequently reachable from untrusted networks, exposure review is required even though ScreenConnect servers themselves are not impacted.
How it works
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted; the issue is in the ScreenConnect client. The CVSS vector (AV:N) indicates network attackability, and CISA directs stakeholders to evaluate each asset's internet exposure. The vendor's mitigations are described in the ConnectWise ScreenConnect security bulletin dated 2026-09-08.
Detection and response
Hypothesis: an active ScreenConnect remote session can transfer and execute files without authorization or Host confirmation. Evidence that confirms or rejects it comes from the vendor bulletin and the CISA KEV entry — the advisory match on CVE-2026-84869, the affected ScreenConnect client (not the server), and the KEV listing added 2026-09-11 with a due date of 2026-09-14. Review remote-session logs for unauthorized file transfers or executions, and apply CISA's Forensics Triage Requirements where compromise is suspected.
What to do
- Inventory. Enumerate all ConnectWise ScreenConnect client installations across endpoints, servers, and golden images. Note version, deployment method, and whether the client is internet-facing or reachable from untrusted networks.
- Patch or mitigate. Apply mitigations in accordance with the ConnectWise ScreenConnect security bulletin (2026-09-08). Follow applicable BOD 26-04 guidance for cloud services; if mitigations are unavailable, discontinue use of the product.
- Verify. Confirm the updated client is running on all in-scope assets. Validate that file transfer and execution through active remote sessions now require authorization and Host confirmation. Re-scan to catch missed or reverted endpoints.
- Restrict exposure. Evaluate each asset's internet exposure and tighten access to ScreenConnect infrastructure and clients consistent with BOD 26-04 patching guidelines.
- Hunt and triage. Review remote-session logs for unauthorized file transfers or executions. Apply CISA's Forensics Triage Requirements where compromise is suspected.
- Close the ticket. Document the patch version, verification evidence, and any compensating controls. Confirm the KEV due date of 2026-09-14 is met and retain records for audit.
FAQ
Is CVE-2026-84869 in CISA KEV? Yes. CISA added CVE-2026-84869 to the Known Exploited Vulnerabilities catalog on 2026-09-11.
What is the CISA due date? The federal remediation due date is 2026-09-14. Organizations should treat this as an emergency patch window.
Is this vulnerability internet-facing? The CVSS vector (AV:N) indicates network attackability, and CISA directs stakeholders to evaluate each asset's internet exposure. ScreenConnect servers are not impacted per the official summary; the issue is in the ScreenConnect client. Still, remote-support tooling is frequently reachable from untrusted networks, so exposure review is required.
Is there a ransomware tie? CISA's KEV entry lists known ransomware use as Unknown. Absence of a confirmed ransomware link does not reduce urgency given confirmed exploitation.
What is the CVSS score? Watchstack reports 9.9 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
What is the EPSS score? Watchstack reports EPSS 0.00691 at the 0.51195 percentile. KEV status takes precedence over low EPSS.
What are the weakness classes? CWE-269 (Improper Privilege Management) and CWE-862 (Missing Authorization).
Which component is affected? The ScreenConnect client. ScreenConnect servers are not impacted.