# CVE-2026-84869: ConnectWise ScreenConnect unauthorized file transfer and execution

Source: https://junglewise.ai/threats/cve-2026-84869-connectwise-screenconnect-unauthorized-file-transfer-and  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-24  
License: CC BY 4.0 with a link back

CVE-2026-84869 · Severity: critical · CVSS 9.9 · Exploited in the wild · Published 2026-09-08

ConnectWise ScreenConnect is a remote access and support platform used by IT teams to manage and troubleshoot systems. A critical vulnerability in this tool allows attackers to transfer and run files on a connected system without proper authorization checks, potentially giving them full control over supported computers. The vulnerability is being actively exploited by attackers in real-world attacks.

Technologies: [ConnectWise ScreenConnect](https://junglewise.ai/threats/technologies/screenconnect). Vendors: [ConnectWise](https://junglewise.ai/threats/vendors/connectwise).

## Quick answers

**Is CVE-2026-84869 exploited in the wild?** Yes. CVE-2026-84869 is known to be exploited in the wild, first recorded on 11 September 2026. Treat it as urgent.

**How severe is CVE-2026-84869?** Critical severity, with a CVSS score of 9.9, published 8 September 2026.

**Which products and versions are affected?** ConnectWise ScreenConnect.

**Is there a fix for CVE-2026-84869?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-84869 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-84869?** Check whether you run ConnectWise ScreenConnect. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from improper privilege management and missing authorization checks in ConnectWise ScreenConnect's file transfer and execution functionality. An attacker with access to an active remote session can bypass authorization controls to transfer arbitrary files and execute code on the target system without requiring explicit user confirmation. The weakness resides in the remote session handling mechanism, which fails to validate user permissions before allowing file operations. No special authentication is required beyond establishing an active remote session. An attacker exploiting this vulnerability can achieve arbitrary code execution and full system compromise. The vendor has released patches; affected users should update to patched versions immediately.

## Affected products

- ConnectWise ScreenConnect

## Timeline

- 2026-09-11: disclosed
- exploited: Being actively exploited in the wild

## Related threats

- [ConnectWise ScreenConnect improper input validation in Host Pass creation](https://junglewise.ai/threats/cve-2026-11596-connectwise-screenconnect-improper-input-validation-in-host-pass)
- [ConnectWise ScreenConnect path traversal](https://junglewise.ai/threats/cve-2024-1708-connectwise-screenconnect-path-traversal)
- [ConnectWise ScreenConnect improper cryptographic signature verification in server](https://junglewise.ai/threats/cve-2026-3564-connectwise-screenconnect-improper-cryptographic-signature)
- [In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension…](https://junglewise.ai/threats/cve-2025-14265-in-versions-of-screenconnect-prior-to-25-8-server-side-validation)
- [ConnectWise ScreenConnect remote code execution via ViewState injection](https://junglewise.ai/threats/cve-2025-3935-connectwise-screenconnect-remote-code-execution-via-viewstate)