CVE-2026-84869

ConnectWise ScreenConnect allows unauthorized file transfer and execution through active remote sessions due to improper privilege management and missing authorization.

This vulnerability enables attackers to execute arbitrary commands and transfer files without host confirmation, directly enabling remote code execution (RCE) and data exfiltration. DIB organizations must patch immediately as this flaw is actively exploited in the wild, posing severe compliance risks under NIST 800-171 for unauthorized access and data integrity. Organizations should verify patch levels on all remote access tools and restrict administrative privileges to mitigate exposure.

Shame score — A critical authorization flaw in a widely deployed remote access tool that is actively exploited in the wild, allowing unauthenticated remote code execution and data theft.