Affected Systems
ConnectWise ScreenConnect versions prior to 26.6.5. Affects ScreenConnect clients used by MSPs and IT teams for remote access and system management. Over 1,000 unpatched instances exposed online, primarily in North America (758) and Europe (180).
Exploitation Status
Actively exploited in the wild. CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities catalog on September 13, 2026. ConnectWise released temporary mitigations on September 7, 2026, before active exploitation was confirmed.
Business Impact
Critical risk for MSPs and organizations using ScreenConnect for remote access. Attackers with basic privileges can transfer and execute files through active remote sessions without authorization or host confirmation. Low attack complexity with no user interaction required. ScreenConnect has been repeatedly targeted by ransomware gangs and state-sponsored groups (including North Korean Kimsuky APT). Compromise could enable lateral movement, data exfiltration, and ransomware deployment across managed client environments.
Urgency
🔴 Immediate
Recommended Actions
- Immediately upgrade ConnectWise ScreenConnect to version 26.6.5 or later on all instances
- If immediate patching is not possible, disable TransferFiles permissions in ScreenConnect as temporary mitigation per ConnectWise guidance
- Audit ScreenConnect access logs for unauthorized file transfers or executions since September 7, 2026
- Inventory all ScreenConnect instances (on-premises and cloud) and verify patch status using Shadowserver or internal scanning
- Review and restrict user privilege levels in ScreenConnect to minimum necessary access