GoKawiilCISA confirms active exploitation of ConnectWise ScreenConnect flaw CVE-2026-84869
CISA has added a critical ScreenConnect vulnerability, now designated CVE-2026-84869, to its known exploited vulnerabilities catalog after confirming attackers are actively abusing it. The flaw stems from missing authorization checks that let low-privilege users transfer and execute files during active remote sessions without host confirmation, and it has been fixed in ScreenConnect 26.6.5. Federal agencies have been given three days to patch, while Shadowserver reports over 1,000 unpatched, internet-exposed ScreenConnect servers, mostly in North America and Europe.
GoKawiil's interpretation of the reporting above, not reported fact.
ScreenConnect is widely used remote-access software, making it an attractive target for both cybercriminals and nation-state actors like North Korea's Kimsuky group, which has previously exploited similar flaws alongside ransomware operators. With over a thousand vulnerable instances still exposed online, organizations that delay patching face a real risk of unauthorized file execution and potential full system compromise.
- CVE-2026-84869 is a critical ScreenConnect flaw allowing unauthorized file transfer and execution.
- CISA mandated federal agencies patch within three days after confirming active exploitation.
- Over 1,000 ScreenConnect servers remain unpatched and exposed, mainly in North America and Europe.
Source: bleepingcomputer.com, 2026-09-16
Published there as: “Critical ScreenConnect flaw now actively exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.