ConnectWise ScreenConnect Privilege Management and Authorization Vulnerability Added to CISA KEV

What's on the official record

11 September — CISA added CVE-2026-84869 to the Known Exploited Vulnerabilities Catalog (catalog version 2026.10.21). The entry describes an improper privilege management (CWE-269) and missing authorization (CWE-862) vulnerability in ConnectWise ScreenConnect that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. CISA's remediation due date for federal civilian agencies is 14 September 2026. The record names no fixed version; the fix field reads "see vendor advisory." The catalog does not record known ransomware use. FIRST's EPSS model estimates a 0.009 probability of exploitation. CISA's ADP assesses exploitation as active, automatable as no, and impact as total.

Assessment

For a platform or AI-stack owner, the record lets you check whether any ScreenConnect instance in your estate is running a version covered by the vendor advisory, and decide whether to patch, isolate, or restrict that instance until the advisory's mitigations are applied. The vulnerability's path through an active remote session makes the remote-access surface the thing to inventory first.

For a cyber underwriter, the record lets you ask a policyholder whether ScreenConnect is in its remote-access estate and whether the vendor advisory's mitigations are in place, and decide whether to require that control or price the exposure accordingly. The catalog's active-exploitation assessment is the basis for treating this as a live, not theoretical, exposure.

For a deal team, the record lets you scope diligence on any target that operates or resells ScreenConnect, checking whether the advisory's mitigations are applied and whether the product sits in a customer-facing remote-access path. That finding can condition price or terms where the target's remediation posture is unverified.

What would change this call

A vendor advisory naming a fixed version, or a CISA update to the catalog entry, would change the patch and pricing guidance above.

What to check next

Confidence

Filed 25 October 2026 from the record dated 11 September 2026.

Sources

[1] ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability — https://nvd.nist.gov/vuln/detail/CVE-2026-84869

[2] CVE record CVE-2026-84869 — https://www.cve.org/CVERecord?id=CVE-2026-84869

[3] CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog