ConnectWise ScreenConnect
ConnectWise's remote support and access software, used by IT providers to control client machines.
ConnectWise ScreenConnect has four flaws on CISA's exploited list; the newest, CVE-2026-84869, was listed on 11 September 2026 and lets files run through a live session without the host's approval.
Last refreshed: 12 October 2026 · Appears in 1 active topic
Why does one remote-support tool keep landing on America's exploited-flaw list?
Timeline for ConnectWise ScreenConnect
Mentioned in: CISA flags N-central flaw as exploited
Cybersecurity: Threats and DefencesBackground
ScreenConnect is the remote support and access tool IT providers use to take control of client machines. ConnectWise runs a cloud edition and also sells a self-hosted server. CISA's catalogue of exploited flaws holds four ScreenConnect entries, the latest CVE-2026-84869, added on 11 September 2026 with a 14 September deadline.
On 19 February 2024 ConnectWise disclosed CVE-2024-1709, an authentication bypass scored 10, together with the PATH traversal flaw CVE-2024-1708. That first bulletin reported no exploitation; CISA listed CVE-2024-1709 as exploited three days later. ConnectWise let customers whose maintenance had lapsed install a fixed build free of charge, and because most customers already ran the hosted, centrally patched version, the flaw did FAR less downstream damage than its install base suggested. CISA added CVE-2024-1708 to its list on 28 April 2026.
On 28 May 2025 ConnectWise said a suspected nation-state actor had breached its environment, affecting a very small number of ScreenConnect customers, and brought in Mandiant. The September 2026 flaw sits in the client rather than the server: ConnectWise's 8 September bulletin tells partners to reinstall host clients and update access agents to version 26.6.5, cloud instances included.
