ConnectWise ScreenConnect Vulnerability CVE-2026-84869: Critical Exploit Alert
- Severity
- HIGH
- Affected component
- connectwise screenconnect (npm)
- Patched version
- Not yet available
A critical vulnerability in ConnectWise ScreenConnect, tracked as CVE-2026-84869, has been confirmed and is actively exploited. Users of ConnectWise ScreenConnect are advised to upgrade immediately.
What happened
The vulnerability in ConnectWise ScreenConnect involves improper privilege management and missing authorization. This allows attackers to transfer files and execute commands through active remote sessions without proper authorization or host confirmation. The flaw was first flagged on September 11, 2026, and confirmed by CISA on September 16, 2026. ConnectWise has released mitigation measures and a patch in version 26.6.5 and later.
CISA has added this vulnerability to its Known Exploited Vulnerabilities catalog and ordered U.S. federal agencies to secure their systems within three days. The exploit has a CVSS score of 9.9, indicating a high severity level.
What to do about it
- Upgrade to the latest version of ConnectWise ScreenConnect to mitigate the risk.
- Review active remote sessions for any unauthorized activity.
- Implement temporary mitigation measures by disabling TransferFiles permissions as advised by ConnectWise.
- Monitor the primary sources for updates on the vulnerability and any additional patches.
How 0Day would have caught this
connectwise screenconnect is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using ConnectWise ScreenConnect, you may be affected. Check your version against the latest patched version, 26.6.5 and later.
What should I do right now?
Upgrade to the latest version of ConnectWise ScreenConnect and review active remote sessions for any unauthorized activity.
Has this been exploited in the wild?
Yes, this vulnerability is actively exploited in the wild according to CISA.