ConnectWise ScreenConnect: Schwachstelle ermöglicht Codeausführung

Weakness classes (CWE)

• CWE-269Class

  Improper Privilege Management

  The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

  cwe.mitre.org →

• CWE-862Class

  Missing Authorization

  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

  cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

1. CVE Modified2026-09-11 04:18 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
   • SSVC: {"id":"CVE-2026-84869","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI… → {"id":"CVE-2026-84869","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
2. CVE Modified2026-09-09 21:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
   • SSVC: {"id":"CVE-2026-84869","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalI…
3. New CVE Received2026-09-08 20:18 UTC· 7d616e1a-3288-43b1-a0dd-0a65d3e70a49
   • Description: A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
   • CVSS V3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
   • CWE: CWE-269
   • CWE: CWE-862

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

• ConnectWise

  ScreenConnect< 26.6.5

  fixed in 26.6.5

Linked CVEs

• CVE-2026-84869

  A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authoriza…

  criticalCVSSv3 9.9