CISA lists critical ScreenConnect flaw as actively exploited
SecurityUnverifiedUpdated:
CISA has reportedly added a critical ConnectWise ScreenConnect flaw to its catalog of actively exploited vulnerabilities and directed U.S. federal agencies to secure affected systems within three days.
File actions during active remote sessions
According to BleepingComputer, CISA says attackers are exploiting CVE-2026-84869, a critical missing-authorization and privilege-management flaw in ConnectWise ScreenConnect. The flaw can reportedly allow attackers with basic privileges to transfer or execute files during active remote sessions without user interaction. ConnectWise patched it in ScreenConnect 26.6.5 and later.
Before the reported active-exploitation designation, ConnectWise had issued temporary mitigation guidance for the flaw and released fixes in ScreenConnect 26.6.5 and later.
The issue has reportedly moved from a disclosed, patched vulnerability to one CISA lists as actively exploited, prompting a three-day remediation deadline for U.S. federal agencies.
An exploitation designation after fixes
ScreenConnect is used by IT providers and managed service providers for remote administration. The reported change places a recently mitigated vulnerability in CISA's actively exploited catalog and attaches an urgent remediation requirement for federal agencies.
Sources
- BleepingComputerCritical ScreenConnect flaw now actively exploited in attacksRead source →