CVE-2026-84869
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Scoring
- Severity
- CRITICAL
- CVSS base score
- 9.9
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- CWE
- CWE-862, CWE-269
- Published
- 2026-09-08
- Last modified
- 2026-09-08
Affected products
- ConnectWise ScreenConnect
Weakness type
Related vulnerabilities
- CVE-2026-68484 — Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API....
- CVE-2026-86765 — Snipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint
- CVE-2026-86764 — Snipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components
- CVE-2026-86762 — Snipe-IT before 8.7.0 Authentication Bypass via API Middleware
- CVE-2026-86759 — Snipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer
- CVE-2026-86757 — Snipe-IT before 8.7.0 Information Disclosure via Custom Fields
- CVE-2026-41871 — Apache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)
- CVE-2026-41869 — Apache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)