CISA adds critical ConnectWise ScreenConnect flaw to exploited vulnerabilities catalog

September 17, 2026 at 12:58 AM2 min

This digest was compiled by AI from multiple sources — links to the originals are below.

The Cybersecurity and Infrastructure Security Agency added a critical ConnectWise ScreenConnect vulnerability to its Known Exploited Vulnerabilities catalog on Sept. 11. The flaw, CVE-2026-84869, carries a CVSS score of 9.9 and allows attackers to transfer and execute files without authorization. ConnectWise released a patch on Sept. 8, three days before the catalog listing.

Key Facts

CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on Sept. 11.
The vulnerability has a CVSS score of 9.9 and stems from improper privilege management and missing authorization.
ConnectWise released a patch for the flaw on Sept. 8.
CISA has added four ScreenConnect flaws to the KEV catalog since 2024, two of which were exploited by ransomware groups.

Vulnerability Details

CVE-2026-84869 is an improper privilege management and missing authorization bug in ConnectWise ScreenConnect. The flaw lets attackers transfer and execute files via an active remote session without authorization or host confirmation. CISA assigned the vulnerability a CVSS score of 9.9, indicating critical severity. ConnectWise released a patch on Sept. 8, three days before CISA added the flaw to the KEV catalog.

Exploitation and Ransomware Risk

CISA confirmed the vulnerability has been exploited in the wild. Since 2024, CISA has added four ScreenConnect flaws to the KEV catalog, two of which were exploited by ransomware groups. Shane Barney, CISO at Keeper Security, said the vulnerability provides a direct path to ransomware deployment. Barney noted that ransomware gangs actively monitor the KEV catalog, shrinking the patch window once a flaw is listed. John Strand of Black Hills Information Security said the time between vulnerability disclosure and active exploitation has become extremely short.

Mitigation Guidance

Barney urged organizations to prioritize patching above standard quarterly or monthly cycles. If immediate patching is not possible, Barney recommended segregating ScreenConnect instances from sensitive network segments and disabling TransferFiles permissions. Organizations with unpatched internet-exposed instances face elevated risk, according to Barney. Strand advised ScreenConnect customers to patch immediately, saying, "Don't wait, get it patched."