CVE-2026-84869

Critical9.9 Published on Sep 8, 2026

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

Actively exploited

In the CISA exploited-vulnerabilities catalogue since Sep 11, 2026
US federal agencies must remediate it by Sep 14, 2026 (BOD 22-01)
Attacked 1 day before the vulnerability was made public

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Source: CISA KEV · Sep 11, 2026 Sep 9, 2026 Sep 8, 2026

CVSS score9.9 / 10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness type (CWE)CWE-269, CWE-862

Vendorsconnectwise

Affected products

Vendors	Product	Versions
connectwise	screenconnect	< 26.6.5.9742

Vulnerabilities

Cisco ISE API Authentication Flaw Opens a Remote Path to Root Access

Cisco warns of exploited CVE-2026-76460 in ISE with CVSS 10.0 enabling unauthenticated remote root access. See affected versions, patches, mitigations.