Vulnerability report

Exploitation attempts observed in the wild Confirmed confidence In CISA KEV

CVE-2026-84869

ScreenConnect Client Guest to Host File Execution

ConnectWise / ScreenConnect · All versions prior to 26.6.5

Watch CVE-2026-84869 Browse KEV feed
Severity
CVSS 9.9 · Critical
Confidence
Confirmed
Exploit status
Exploitation attempts observed in the wild
EPSS
0.9%
First observed
—
Last observed
—

Decision summary

What security teams need to know first

Direct answers before the deeper technical record.

What it is

CVE-2026-84869 is a vulnerability affecting ConnectWise ScreenConnect. A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or...

Have exploitation attempts been observed?

Yes. Exploitation attempts have been reported for this vulnerability. Previdian lists it as a known exploited vulnerability. Listed in CISA KEV. Also reported by third-party sources. Confidence is confirmed.

Who is affected?

ConnectWise / ScreenConnect all versions prior to 26.6.5.

What should we do?

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

Overview

ScreenConnect Client Guest to Host File Execution

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances.

ScreenConnect servers are not impacted.

ConnectWise Affected
ScreenConnect
All versions prior to 26.6.5
Published
08 Sep 2026
Exploitation Attempts Reported
09 Sep 2026
Attack vector
Remote
Complexity
Low
Privileges
Low
User interaction
None

Tags

cisa

CVE References

Exploitation evidence

Evidence of exploitation attempts

Third-party attestation and first-party sensor observation are shown separately so teams can judge the evidence chain.

Exploitation attempts observed in the wild

Huntress Blog

Recorded 09 Sep 2026

A trusted third party reported exploitation attempts.

Known exploited vulnerability sources

Per-source evidence links for KEV attestations are available through the Previdian Pro API.

Learn about Pro API access
Source Added
Huntress Blog First 2026-09-09 07:51 UTC
CISA 2026-09-11 18:30 UTC
CVE 2026-09-11 19:01 UTC

Detection

Operational artifacts and observed signals

Make the evidence actionable in scanner, SOC, and edge-control workflows.

Scanner coverage

No scanner integrations recorded yet.

Virtual patch status

No Previdian virtual patch is currently available. Future rules ship for ModSecurity, Cloudflare, and AWS WAF.

Learn about virtual patches →

No detection artifacts or sensor request patterns are available for this CVE yet.

Check back as sensor telemetry and scanner integrations are updated.

Risk and context

Severity, weaknesses, and research context

CVSS v3.1

9.9 Critical

Potential damage if exploited. Separate from whether attackers are using it.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS

0.9%

Estimated chance of exploitation in the next 30 days. Previdian's warning comes from evidence, not this score.

Weaknesses

Improper Privilege Management CWE-269 Missing Authorization CWE-862

Recent mention · Arctic Wolf

PHP2Shell Is a Wake-Up Call for Every Business Leader

AI is changing how vulnerabilities are discovered and exploited for defenders and attackers alike, and the practical effect is that the time organizations have between a flaw being found and a flaw being exploited keeps shrinking. Today, we have more known vulnerabilities than...

Read full advisory

All Mentions

Recent mention · Arctic Wolf

PHP2Shell Is a Wake-Up Call for Every Business Leader

Arctic Wolf · 26 Oct 2026

AI is changing how vulnerabilities are discovered and exploited for defenders and attackers alike, and the practical effect is that the time organizations have between a flaw being found and a flaw being exploited keeps shrinking. Today, we have more known vulnerabilities than at any point in history, and they’re being exploited faster than ever. ... PHP2Shell Is a Wake-Up Call for Every Business Leader

Recent mention · Arctic Wolf

Beyond the Inbox: How Threat Actors Abuse Microsoft Teams External Chat for Initial Access

Arctic Wolf · 26 Oct 2026

Arctic Wolf has observed a recurring social engineering pattern in more than 400 incidents where threat actors have used Microsoft Teams' external chat creation feature for impersonation scams, or to deliver malicious files.

Recent mention · Arctic Wolf

Inside Arctic Wolf and Anthropic’s Trust-First Approach to the Agentic SOC

Arctic Wolf · 15 Oct 2026

In the recently released 2026 SANS AI in Cybersecurity Survey, nearly two out of three security professionals said they have been given AI-generated guidance that later turned out to be wrong. Not from an experimental tool off in a sandbox, but from systems built into the security stack they were told to rely on. Security ... Inside Arctic Wolf and Anthropic’s Trust-First Approach to the Agentic SOC

Recent mention · Arctic Wolf

How the Aurora® Superintelligence Platform and Aurora Agentic SOC Help You Understand and Secure AI

Arctic Wolf · 14 Oct 2026

AI now plays a central role in defending organizations from the modern threat landscape. It triages alerts, investigates security events, and recommends what to do next. AI is critical to defending at machine speed, but security leaders can’t see how it is making decisions on their behalf. This visibility challenge creates multiple downstream problems for ... How the Aurora® Superintelligence Platform and Aurora Agentic SOC Help You Understand and Secure AI

Recent mention · Arctic Wolf

How Aurora® Adaptive Threat Protection Spots Attacker Intent Early

Arctic Wolf · 14 Oct 2026

Imagine this: There’s an active attack but no alert. Nothing looks wrong. Every login is valid. Every tool is trusted. Every command is one your team has run before. This invisible attack chain is how many attackers work today, and they can take control of a domain in minutes and encrypt an environment while evading ... How Aurora® Adaptive Threat Protection Spots Attacker Intent Early

Recent mention · Arctic Wolf

Beyond Triage: How the Aurora Agentic SOC Enhances the Concierge Experience

Arctic Wolf · 02 Oct 2026

A lot of the current conversation about agentic SOCs is about triage. Faster detection, faster investigation, alerts resolved in minutes instead of hours. When we set out to build the Aurora® Agentic SOC, we didn’t just want to make triage faster. We fundamentally re-engineered our SOC to strengthen every job it does, and enhancing the ... Beyond Triage: How the Aurora Agentic SOC Enhances the Concierge Experience

Recent mention · Arctic Wolf

AI Threats Are Evolving Fast. Your Employees Are Still the Last Line of Defense.

Arctic Wolf · 01 Oct 2026

New training on using AI safely and spotting AI-powered threats arrives this Cybersecurity Awareness Month Attackers are moving faster than ever, weaponizing newly discovered vulnerabilities before defenders can patch them and building new types of malware that signature-based defenses can’t catch. Thousands of organizations around the world rely on our Aurora® Superintelligence Platform, a best-in-class ... AI Threats Are Evolving Fast. Your Employees Are Still the Last Line of Defense.

Recent mention · Arctic Wolf

How the Aurora Agentic SOC Is Building the Next Generation of SOC Analysts

Arctic Wolf · 25 Sep 2026

AI is changing how security operations work. It can process more data, reduce repetitive work, and move investigations forward faster than human teams could on their own. But speed and scale are not the only factors security leaders should be considering. The more important question is what happens to human expertise when machines take on ... How the Aurora Agentic SOC Is Building the Next Generation of SOC Analysts

Timeline

From disclosure to observed exploitation attempts

  1. 19:01 UTC

    KEV confirmed by CVE

    Exploitation attempts reported by an external source

  2. 18:30 UTC

    Added to CISA KEV

    Listed in the CISA Known Exploited Vulnerabilities catalog

  3. 07:51 UTC

    Added to Previdian KEV Feed

    High-confidence, third-party report of exploitation attempts

  4. 19:29 UTC

    CVE published

    Vulnerability disclosed publicly

  5. 13:57 UTC

    CVE ID reserved

    Identifier reserved by the CNA

Pro API

Automate this intelligence

Confidence, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

Start 14-day Pro trial Read API docs
  • Evidence confidence and provenance
  • First-party sensor telemetry
  • PoC and scanner references
  • Affected versions and enrichment
  • Automation-ready JSON delivery

GET /api/v2/pro/kevs/CVE-2026-84869

Sample API response 
{
  "cve_id": "CVE-2026-84869",
  "confidence": "Confirmed",
  "cvss_score": 9.9,
  "cvss_estimated": false,
  "epss_score": 0.00924,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "attempts": 0, "sensors": 0 }
}