CVE-2026-84869

ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

CVSS 9.9 critical · ConnectWise ScreenConnect · published 2026-09-08

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

NVD · CVE.org

Coverage 1 source

1. 2026-09-11 CISA Cybersecurity Advisories critical CISA Adds Three Known Exploited Vulnerabilities to Catalog

   CISA added three exploited vulnerabilities to its KEV Catalog: CVE-2026-42016, CVE-2026-42018, and CVE-2026-84869.

Mentioned with

CVE-2026-42016 CVE-2026-42018

Also covered

• CVE-2026-86950 Apple iOS and iPadOS CVSS 8.8 · 1 article · 2026-09-29
• CVE-2023-6548 Cloud Software Group NetScaler ADC CVSS 5.5 · 1 article · 2026-09-28
• CVE-2023-25608 Fortinet FortiAP-W2 CVSS 5.2 · 1 article · 2026-09-28
• CVE-2026-88772 Memory overflow vulnerability leading to Remote Code Execution or Denial of Service CVSS 9.5 · 3 articles · 2026-09-28
• CVE-2026-88771 A remote code execution vulnerability exists due to improper input validation, which can allow an unauthenticated attacker to execute arbitrary commands CVSS 9.5 · 3 articles · 2026-09-28