Vulnerability Intelligence Report
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
CVE-2026-84869
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
CISA KEV
SSVC: Active Exploitation
Privilege Escalation
CVSS Base Score
9.9
CRITICAL
Exploitability:3.2
Impact Score:6.1
EPSS Probability:0.38%
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| ConnectWise | ScreenConnect | All versions prior to 26.6.5 (affected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
CISA KEV
ACTIVE IN CATALOG
EPSS Score
0.382%
GitHub Advisory
Vulnerability Class
Privilege Escalation
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | ConnectWise LLC · Vendor · USA |
| Reserved | 2026-09-02T13:57:51 |
| Published | 2026-09-08T19:29:33 |
| Last Updated | 2026-09-12T03:55:19 |
Community Chatter & Buzz