CVE-2026-84869 · High · CISA KEV

ConnectWise ScreenConnect: Privilege Management & Auth Bypass in KEV

Threat Engine Auto-Feed · data current as of 2026-09-12

ConnectWise ScreenConnect has been observed exploited in the wild, indicating a high exploitation pressure. This vulnerability combines improper privilege management and missing authorization, allowing unauthorized file transfer and execution during active remote sessions. Organizations using ScreenConnect are at risk of unauthorized code execution and data manipulation.

  • CVSS:
  • EPSS percentile: 0.50847
  • Exploitation pressure: 56/100 (High)

Exploitation reality: listed in CISA KEV (exploited in the wild) · EPSS 51th percentile. Threat × Vulnerability from public signals — impact depends on your environment.

Weakness —

This vulnerability involves two core issues: 'improper privilege management' means the software doesn't correctly handle or enforce user permissions, potentially allowing a low-privileged user to perform actions reserved for higher-privileged users. 'Missing authorization' means the software fails to check if a user is allowed to perform a specific action before letting them do it, leading to unauthorized access or actions.

Who's at risk

Exposure: unknown · Auth: unknown · unknown

Enterprise profiles most at risk

  • Organizations utilizing ConnectWise ScreenConnect for remote support or management, particularly those in Financial Services and Technology sectors due to observed adversary targeting.
  • Environments with active remote sessions where ScreenConnect is deployed.

Misconfigurations that escalate it

  • Lack of strict access controls or monitoring on ScreenConnect instances.
  • Insufficient logging of remote session activities.

High-impact scenarios

  • Unauthorized file transfer and execution on connected endpoints during active remote sessions, leading to potential malware deployment or system compromise.
  • Attackers gaining unauthorized control over remote systems without host confirmation, enabling lateral movement or data exfiltration.

Likely adversaries

  • FIN7 — Financial services (Assessed)
  • LockBit affiliates — Financial services (Assessed)
  • APT38 (Lazarus) — Financial services (Assessed)
  • APT29 (Cozy Bear) — Technology (Assessed)
  • Scattered Spider — Technology (Assessed)

What to do (defensive)

Detect

  • Monitor ConnectWise ScreenConnect logs for unusual file transfer activities or unauthorized execution commands.
  • Implement network intrusion detection systems (NIDS) to flag suspicious activity originating from ScreenConnect endpoints.
  • Regularly audit active remote sessions for unexpected or unapproved connections.

Contain

  • Isolate affected ScreenConnect instances or endpoints if unauthorized activity is detected.
  • Terminate all active remote sessions if compromise is suspected.
  • Review and restrict network access to ScreenConnect servers to only necessary personnel and IP ranges.

Patch

  • Apply the latest security updates and patches for ConnectWise ScreenConnect as soon as they become available from the vendor.

Frontier verdict — High

High priority due to confirmed in-the-wild exploitation (CISA KEV) and potential for unauthorized code execution via privilege management and authorization bypass.

For detection-engineering and awareness only · point-in-time · not security advice · sourced from NVD, FIRST EPSS, CISA KEV. Adversary mappings are assessments unless cited.