DaystoPatch

ConnectWiseExploited incident

ConnectWise ScreenConnect client file transfer and execution without authorization (26.6.5 bulletin)

CVE-2026-84869Critical, CVSS 9.9In CISA's Known Exploited Vulnerabilities catalog since 11 Sep 2026

  • Exploited before a fix
FixedFixed for every supported version 5 days after the first public report.
Embed this live clock

Response

Silence
same day
First public report to first vendor statement
Exposure
5d
First public report to first fix
Follow-through
5d
First public report to a fix for every supported version
  • Vendor silent
  • Vendor statement, no fix
  • Fixed for some versions
  • Fixed when disclosed
  • Date only, no time of day

Timeline and evidence

Open a moment to see its source and archived quote.

  1. First public report

    date only

    ConnectWise Trust Center advisories page, 'September 3, 2026: ScreenConnect Remote Access: Guest File Transfer Advisory' (archived 2026-09-05)CuratedQuote verified

    A CVE identifier and an official fix will be issued within the week.

    The vendor's own advisory was the first public signal that the bug existed, published before any fix. The entry is headed 'September 3, 2026'.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7264725d5fe7f2b4…
    Used in metrics
    Yes
    Dispute this timestamp
    5 more sources for this moment
    Huntress blog: Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like ActivityCuratedQuote verified3 Sep 2026

    UPDATE 9/3/26 at 5:45 ET

    Huntress's original post reported in-the-wild activity (late-August incidents in which rogue ScreenConnect clients transferred and ran VBScript files on connected hosts). The page's structured data gives datePublished 2026-09-03T08:50:00.000Z, but the visible page only shows 'Last Updated: September 8, 2026' and this 9/3/26 update, so day precision is used. Huntress tied the activity to CVE-2026-84869 only after the fix; ConnectWise has not confirmed the link.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7abdd63dbe8d3871…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CVE.org record CVE-2026-84869ClaimedQuote verified8 Sep 2026, 19:29 UTC

    A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances.

    CVE record published.

    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:4901faa8dbe55967…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Bluesky postClaimedQuote not checked yet8 Sep 2026, 21:00 UTC

    🔴 CVE-2026-84869 - Critical (9.9)

    Earliest third-party post we hold.

    Source
    Bluesky post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    CISA KEV (CVE-2026-84869)ClaimedQuote verified11 Sep 2026

    ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability

    Added to CISA's KEV catalog on 2026-09-11.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Claimed. The date the source gives.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:ef8fffede5c47200…
    Used in metrics
    No, kept for the record
    Dispute this timestamp
    Mastodon postClaimedQuote not checked yet11 Sep 2026, 21:00 UTC

    🚨 [CISA-2026:0911] CISA Adds 4 Known Exploited Vulnerabilities to Catalog ( https:// secdb.nttzen.cloud/security-ad visory/detail/CISA-2026:0911 ) CISA has added 4 new vulnerabilities to its Known

    Earliest third-party post we hold.

    Source
    Mastodon post social
    Recorded time
    Precision
    To the minute
    Origin
    Claimed. The date the source gives.
    Quote check
    Not checked yet
    Snapshot
    No archived snapshot
    Used in metrics
    No, kept for the record
    Dispute this timestamp

  2. Vendor statement

    date onlysame day

    ConnectWise Trust Center advisories page (Guest File Transfer Advisory, updated September 9, 2026)CuratedQuote verified

    This advisory was originally published on September 3, 2026, to provide interim mitigation guidance before the security update became generally available.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:1354bf7f78ec34af…
    Used in metrics
    Yes
    Dispute this timestamp

  3. First workaround

    date onlysame day

    ConnectWise Trust Center advisories page, September 3, 2026 entry (archived 2026-09-05)CuratedQuote verified

    Fix in development; interim mitigation available now

    Status line of the original advisory. Mitigation: deselect the TransferFiles (or TransferFilesInSession on legacy versions) permission for every session group in every role. Published with the original September 3, 2026 advisory.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:7264725d5fe7f2b4…
    Used in metrics
    Yes
    Dispute this timestamp

  4. First fix

    date only+5d

    ConnectWise security bulletin: ScreenConnect 26.6.5 Security PatchCuratedQuote verified

    Date: 09/08/2026

    Bulletin date only (US format, 8 September 2026). Huntress's blog update stamped '9/8/26 at 9pm ET' also reports the release.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:dc6c55133355b173…
    Used in metrics
    Yes
    Dispute this timestamp

  5. Fixed for all versions

    date only+5d

    ConnectWise security bulletin: ScreenConnect 26.6.5 Security PatchCuratedQuote verified

    Cloud instances have already been updated to version 26.6.5.

    Single fixed version (26.6.5) for all on-premises installs, released with the 09/08/2026 bulletin; cloud instances updated by ConnectWise (no exact date given for the cloud rollout). On-premises licenses out of maintenance must be renewed before upgrading.

    Recorded time
    Precision
    Date only (no time of day is shown)
    Origin
    Curated. Found by a researcher, with a verbatim quote and link.
    Quote check
    Found in the archived copy
    Snapshot
    sha256:dc6c55133355b173…
    Used in metrics
    Yes
    Dispute this timestamp

Send this to your boss

ConnectWise ScreenConnect client flaw exploited; fixed in version 26.6.5

A flaw in the ScreenConnect remote-support client let files be sent to and run on a connected computer without the user's approval; ConnectWise fixed it in ScreenConnect 26.6.5 on 8 September 2026.

In plain words

ScreenConnect is a remote-support tool that lets technicians connect to staff computers. A flaw allowed files to be pushed to and run on a connected computer without the user agreeing, and US authorities report it has been used in attacks. ConnectWise published a temporary workaround on 3 September 2026 and a fix, version 26.6.5, on 8 September; cloud customers were updated automatically. If we run ScreenConnect ourselves, we need to upgrade to 26.6.5 and reinstall the client software on the computers it manages.

What happened and who is affected

What happened

On 3 September 2026 ConnectWise warned of an issue in ScreenConnect file transfer behaviour and published an interim mitigation, before a fix existed. On 8 September it released ScreenConnect 26.6.5 and assigned CVE-2026-84869 (CVSS 9.9), describing a client-side condition that can let files be transferred and executed through an active remote session without authorization or host confirmation. Huntress had reported late-August attacks in which rogue ScreenConnect clients pushed scripts to connected machines, and says it believes this flaw was used; ConnectWise has not confirmed that link. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 11 September 2026.

Who is affected

ConnectWise ScreenConnect versions prior to 26.6.5 (the client used in Support and Access sessions). ScreenConnect servers are not impacted. Cloud instances were updated to 26.6.5 by ConnectWise.

CVE-2026-84869. Reviewed 22 Oct 2026. https://daystopatch.com/incidents/connectwise-cve-2026-84869/

Affected products

  • ConnectWise ScreenConnect (client, Support and Access sessions)
How we built this timeline

Vendor disclosed the issue (no CVE, no fix) on 3 Sep 2026 with an interim mitigation; fix ScreenConnect 26.6.5 and CVE-2026-84869 followed on 8 Sep 2026. exploited before a fix is true on the strength of Huntress's public reporting of late-August 2026 in-the-wild activity (blog first published 3 Sep 2026 per page metadata) and Huntress researcher John Hammond's statement to Help Net Security (update stamped September 11, 2026, 09:28 a.m. ET) that CVE-2026-84869 is what they believe the attackers used;

ConnectWise has not confirmed the link (Help Net Security update, September 7, 2026). BleepingComputer (September 7, 2026) says the advisory was 'issued on Thursday', i.e. 3 Sep 2026, consistent with the vendor page.

The bulletin rates the issue 'Important' with priority '1 - High' while the CVSS v3.1 base score is 9.9; severity here follows the CVSS number.

Related

No related incidents.

ConnectWise report card