CVE Tools
Track your stack

Critical ScreenConnect flaw now actively exploited in attacks

BleepingComputerBy Sergiu Gatlan

Reported exploitedScreenConnectKimsuky

Our summary

CISA has added ConnectWise ScreenConnect vulnerability CVE-2026-84869 to its Known Exploited Vulnerabilities catalog after attacks began targeting the flaw. The missing-authorization and privilege-management issue affects ScreenConnect clients before version 26.6.5 and can let attackers with basic privileges transfer or run files during active remote sessions without host confirmation. Organizations should update to ScreenConnect 26.6.5 or later, as exposed unpatched instances remain reachable online.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. BleepingComputerConnectWise warns of new ScreenConnect flaw without patchCVE-2024-1709, CVE-2025-3935 +1
  2. Help Net SecurityFake payroll desktop apps hand attackers a route to company paychecksCVE-2026-3564
  3. SecurityWeekConnectWise Patches ScreenConnect Vulnerability Exploited in Worm-Like AttacksCVE-2026-84869
  4. The Hacker NewsCISA Adds 5 Actively Exploited Artifactory, ScreenConnect, and RouterOS Flaws to KEVCVE-2026-84869
  5. Help Net SecurityAttackers spread malware through ScreenConnect file transfersCVE-2024-1709
  6. The Hacker NewsChina-Linked Hackers Deploy New StormEncryptor Ransomware, Likely via N-central FlawCVE-2024-1709

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store