Critical ConnectWise ScreenConnect Authentication Flaw Exploited in the Wild
Active Exploitation · 13 sources · Updated 1mo ago · First seen Sep 9, 2026
ConnectWise released ScreenConnect version 26.6.5 to address CVE-2026-84869, a critical authentication failure in its remote-access product. The Canadian Centre for Cyber Security reported that open-source reporting showed active exploitation of the flaw in the wild as of September 8, while CSO Online reported that the issue had remained unresolved for five days before the patch was issued.
Organizations running ScreenConnect versions earlier than 26.6.5 should promptly apply the vendor's security update and review ConnectWise security bulletins for associated guidance. Because ScreenConnect provides remote administrative access, defenders should also investigate for unauthorized access or anomalous activity on exposed ScreenConnect infrastructure, particularly where patching was delayed.
