Connectwise - GoKawiil

CISA confirms active exploitation of ConnectWise ScreenConnect flaw CVE-2026-84869

CISA has added a critical ScreenConnect vulnerability, now designated CVE-2026-84869, to its known exploited vulnerabilities catalog after confirming attackers are actively abusing it. The flaw stems from missing authorization checks that let low-privilege users transfer and execute files during active remote sessions without host confirmation, and it has been fixed in ScreenConnect 26.6.5. Federal agencies have been given three days to patch, while Shadowserver reports over 1,000 unpatched, internet-exposed ScreenConnect servers, mostly in North America and Europe.

bleepingcomputer.com · 2026-09-16

ConnectWise flags unpatched ScreenConnect file-transfer flaw, urges manual fix

ConnectWise disclosed a new security flaw in its ScreenConnect remote access platform affecting file transfer behavior in both cloud and on-premises deployments. The vulnerability has no CVE identifier yet and no official patch, though the company says a fix is coming later this week. In the meantime, ConnectWise published manual mitigation steps requiring administrators to disable file transfer permissions across user roles.

bleepingcomputer.com · 2026-09-07