[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-84869":6},{"stargazers_count":4,"fetched_at":5},7,"2026-09-12T01:55:19.833Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":433,"aliases":434,"duplicate_of":9,"upstream":435,"downstream":436,"duplicates":437,"related":438,"reserved_at":9,"published_at":439,"modified_at":440,"state":441,"summary":442,"references_raw":453,"kevs":479,"epss":490,"epss_history":492,"metrics":500,"affected":508},"CVE-2026-84869","A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.",null,[11,229],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-862","Missing Authorization","The product does not perform an authorization check when an actor attempts to access a resource or perform an action.","weakness","Incomplete","Class","High",[20],{"id":21,"name":22,"techniques":23},"CAPEC-665","Exploitation of Thunderbolt Protection Flaws",[24,61,101],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1211","Exploitation for Stealth",[28,31],{"id":29,"name":30},"TA0030","Defense Evasion",{"id":32,"name":33},"TA0005","Stealth",[35,40,45,49,53,57],{"id":36,"name":37,"tactic":38},"D3-PSEP","Process Segment Execution Prevention",{"name":39},"Harden",{"id":41,"name":42,"tactic":43},"D3-MBT","Memory Boundary Tracking",{"name":44},"Detect",{"id":46,"name":47,"tactic":48},"D3-PCSV","Process Code Segment Verification",{"name":44},{"id":50,"name":51,"tactic":52},"D3-SFCV","Stack Frame Canary Validation",{"name":39},{"id":54,"name":55,"tactic":56},"D3-SSC","Shadow Stack Comparisons",{"name":44},{"id":58,"name":59,"tactic":60},"D3-SAOR","Segment Address Offset Randomization",{"name":39},{"id":62,"name":63,"tactics":64,"countermeasures":70},"T1542.002","Component Firmware",[65,66,67],{"id":29,"name":30},{"id":32,"name":33},{"id":68,"name":69},"TA0110","Persistence",[71,75,79,83,87,92,97],{"id":72,"name":73,"tactic":74},"D3-FEMC","Firmware Embedded Monitoring Code",{"name":44},{"id":76,"name":77,"tactic":78},"D3-FV","Firmware Verification",{"name":44},{"id":80,"name":81,"tactic":82},"D3-FBA","Firmware Behavior Analysis",{"name":44},{"id":84,"name":85,"tactic":86},"D3-SU","Software Update",{"name":39},{"id":88,"name":89,"tactic":90},"D3-SWI","Software Inventory",{"name":91},"Model",{"id":93,"name":94,"tactic":95},"D3-RS","Restore Software",{"name":96},"Restore",{"id":98,"name":99,"tactic":100},"D3-AVE","Asset Vulnerability Enumeration",{"name":91},{"id":102,"name":103,"tactics":104,"countermeasures":113},"T1556","Modify Authentication Process",[105,106,109,110],{"id":29,"name":30},{"id":107,"name":108},"TA0112","Defense Impairment",{"id":68,"name":69},{"id":111,"name":112},"TA0031","Credential Access",[114,119,123,128,132,136,140,144,148,152,156,160,164,168,173,177,181,185,189,193,197,201,205,209,213,217,221,225],{"id":115,"name":116,"tactic":117},"D3-LFP","Local File Permissions",{"name":118},"Isolate",{"id":120,"name":121,"tactic":122},"D3-HBPI","Hardware-based Process Isolation",{"name":118},{"id":124,"name":125,"tactic":126},"D3-FEV","File Eviction",{"name":127},"Evict",{"id":129,"name":130,"tactic":131},"D3-HS","Host Shutdown",{"name":127},{"id":133,"name":134,"tactic":135},"D3-PSMD","Process Self-Modification Detection",{"name":44},{"id":137,"name":138,"tactic":139},"D3-CQ","Content Quarantine",{"name":118},{"id":141,"name":142,"tactic":143},"D3-ABPI","Application-based Process Isolation",{"name":118},{"id":145,"name":146,"tactic":147},"D3-SFA","System File Analysis",{"name":44},{"id":149,"name":150,"tactic":151},"D3-PT","Process Termination",{"name":127},{"id":153,"name":154,"tactic":155},"D3-SCF","System Call Filtering",{"name":118},{"id":157,"name":158,"tactic":159},"D3-AM","Access Modeling",{"name":91},{"id":161,"name":162,"tactic":163},"D3-RC","Restore Configuration",{"name":96},{"id":165,"name":166,"tactic":167},"D3-FE","File Encryption",{"name":39},{"id":169,"name":170,"tactic":171},"D3-DF","Decoy File",{"name":172},"Deceive",{"id":174,"name":175,"tactic":176},"D3-FIM","File Integrity Monitoring",{"name":44},{"id":178,"name":179,"tactic":180},"D3-CF","Content Filtering",{"name":118},{"id":182,"name":183,"tactic":184},"D3-FA","File Analysis",{"name":44},{"id":186,"name":187,"tactic":188},"D3-WSAM","Web Session Access Mediation",{"name":118},{"id":190,"name":191,"tactic":192},"D3-CI","Configuration Inventory",{"name":91},{"id":194,"name":195,"tactic":196},"D3-RF","Restore File",{"name":96},{"id":198,"name":199,"tactic":200},"D3-PSA","Process Spawn Analysis",{"name":44},{"id":202,"name":203,"tactic":204},"D3-PLA","Process Lineage Analysis",{"name":44},{"id":206,"name":207,"tactic":208},"D3-RFAM","Remote File Access Mediation",{"name":118},{"id":210,"name":211,"tactic":212},"D3-CM","Content Modification",{"name":118},{"id":214,"name":215,"tactic":216},"D3-NTPM","Network Traffic Policy Mapping",{"name":91},{"id":218,"name":219,"tactic":220},"D3-KBPI","Kernel-based Process Isolation",{"name":118},{"id":222,"name":223,"tactic":224},"D3-PS","Process Suspension",{"name":127},{"id":226,"name":227,"tactic":228},"D3-HR","Host Reboot",{"name":127},{"_key":230,"id":230,"name":231,"description":232,"type":15,"status":233,"abstraction":17,"likelihood_of_exploit":234,"capec":235},"CWE-269","Improper Privilege Management","The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.","Draft","Medium",[236,351,429],{"id":237,"name":238,"techniques":239},"CAPEC-122","Privilege Abuse",[240],{"id":241,"name":242,"tactics":243,"countermeasures":248},"T1548","Abuse Elevation Control Mechanism",[244,245],{"id":29,"name":30},{"id":246,"name":247},"TA0111","Privilege Escalation",[249,251,253,257,259,263,267,269,271,273,277,281,285,287,289,293,295,297,301,305,307,311,313,315,319,323,327,329,331,333,335,337,339,343,347],{"id":157,"name":158,"tactic":250},{"name":91},{"id":190,"name":191,"tactic":252},{"name":91},{"id":254,"name":255,"tactic":256},"D3-DI","Data Inventory",{"name":91},{"id":214,"name":215,"tactic":258},{"name":91},{"id":260,"name":261,"tactic":262},"D3-AEM","Application Exception Monitoring",{"name":44},{"id":264,"name":265,"tactic":266},"D3-SCA","System Call Analysis",{"name":44},{"id":145,"name":146,"tactic":268},{"name":44},{"id":182,"name":183,"tactic":270},{"name":44},{"id":174,"name":175,"tactic":272},{"name":44},{"id":274,"name":275,"tactic":276},"D3-OPM","Operational Process Monitoring",{"name":44},{"id":278,"name":279,"tactic":280},"D3-DA","Dynamic Analysis",{"name":44},{"id":282,"name":283,"tactic":284},"D3-EFA","Emulated File Analysis",{"name":44},{"id":198,"name":199,"tactic":286},{"name":44},{"id":124,"name":125,"tactic":288},{"name":127},{"id":290,"name":291,"tactic":292},"D3-AL","Account Locking",{"name":127},{"id":169,"name":170,"tactic":294},{"name":172},{"id":165,"name":166,"tactic":296},{"name":39},{"id":298,"name":299,"tactic":300},"D3-AA","Agent Authentication",{"name":39},{"id":302,"name":303,"tactic":304},"D3-CDP","Change Default Password",{"name":39},{"id":120,"name":121,"tactic":306},{"name":118},{"id":308,"name":309,"tactic":310},"D3-SCP","System Configuration Permissions",{"name":39},{"id":161,"name":162,"tactic":312},{"name":96},{"id":194,"name":195,"tactic":314},{"name":96},{"id":316,"name":317,"tactic":318},"D3-ULA","Unlock Account",{"name":96},{"id":320,"name":321,"tactic":322},"D3-RUAA","Restore User Account Access",{"name":96},{"id":324,"name":325,"tactic":326},"D3-RD","Restore Database",{"name":96},{"id":153,"name":154,"tactic":328},{"name":118},{"id":178,"name":179,"tactic":330},{"name":118},{"id":115,"name":116,"tactic":332},{"name":118},{"id":206,"name":207,"tactic":334},{"name":118},{"id":137,"name":138,"tactic":336},{"name":118},{"id":210,"name":211,"tactic":338},{"name":118},{"id":340,"name":341,"tactic":342},"D3-UAP","User Account Permissions",{"name":118},{"id":344,"name":345,"tactic":346},"D3-EAL","Executable Allowlisting",{"name":118},{"id":348,"name":349,"tactic":350},"D3-EDL","Executable Denylisting",{"name":118},{"id":352,"name":247,"techniques":353},"CAPEC-233",[354],{"id":241,"name":242,"tactics":355,"countermeasures":358},[356,357],{"id":29,"name":30},{"id":246,"name":247},[359,361,363,365,367,369,371,373,375,377,379,381,383,385,387,389,391,393,395,397,399,401,403,405,407,409,411,413,415,417,419,421,423,425,427],{"id":157,"name":158,"tactic":360},{"name":91},{"id":190,"name":191,"tactic":362},{"name":91},{"id":254,"name":255,"tactic":364},{"name":91},{"id":214,"name":215,"tactic":366},{"name":91},{"id":260,"name":261,"tactic":368},{"name":44},{"id":264,"name":265,"tactic":370},{"name":44},{"id":145,"name":146,"tactic":372},{"name":44},{"id":182,"name":183,"tactic":374},{"name":44},{"id":174,"name":175,"tactic":376},{"name":44},{"id":274,"name":275,"tactic":378},{"name":44},{"id":278,"name":279,"tactic":380},{"name":44},{"id":282,"name":283,"tactic":382},{"name":44},{"id":198,"name":199,"tactic":384},{"name":44},{"id":124,"name":125,"tactic":386},{"name":127},{"id":290,"name":291,"tactic":388},{"name":127},{"id":169,"name":170,"tactic":390},{"name":172},{"id":165,"name":166,"tactic":392},{"name":39},{"id":298,"name":299,"tactic":394},{"name":39},{"id":302,"name":303,"tactic":396},{"name":39},{"id":120,"name":121,"tactic":398},{"name":118},{"id":308,"name":309,"tactic":400},{"name":39},{"id":161,"name":162,"tactic":402},{"name":96},{"id":194,"name":195,"tactic":404},{"name":96},{"id":316,"name":317,"tactic":406},{"name":96},{"id":320,"name":321,"tactic":408},{"name":96},{"id":324,"name":325,"tactic":410},{"name":96},{"id":153,"name":154,"tactic":412},{"name":118},{"id":178,"name":179,"tactic":414},{"name":118},{"id":115,"name":116,"tactic":416},{"name":118},{"id":206,"name":207,"tactic":418},{"name":118},{"id":137,"name":138,"tactic":420},{"name":118},{"id":210,"name":211,"tactic":422},{"name":118},{"id":340,"name":341,"tactic":424},{"name":118},{"id":344,"name":345,"tactic":426},{"name":118},{"id":348,"name":349,"tactic":428},{"name":118},{"id":430,"name":431,"techniques":432},"CAPEC-58","Restful Privilege Elevation",[],[],[],[],[],[],[],"2026-09-08T19:29:33.630Z","2026-09-11T19:58:23.379Z","Analyzed",{"cisa_kev":443,"cisa_ransomware":444,"cisa_vendor":445,"epss_severity":446,"epss_score":447,"severity":448,"severity_score":449,"severity_version":450,"severity_source":451,"severity_vector":452,"severity_status":441},true,false,"ConnectWise","low",0.00382,"critical",9.9,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",[454,460,465,469,473],{"url":455,"sources":456,"tags":458},"https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin",[451,457],"nvd",[459],"Vendor Advisory",{"url":461,"sources":462,"tags":463},"https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869",[451,457],[464],"Third Party Advisory",{"url":466,"sources":467,"tags":468},"https://www.connectwise.com/company/trust/advisories",[451,457],[459],{"url":470,"sources":471,"tags":472},"https://www.huntress.com/blog/rogue-screenconnect-installations",[451,457],[464],{"url":474,"sources":475,"tags":476},"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869",[451,457],[477,478],"Government Resource","US Government Resource",[480],{"source":481,"vendor":445,"product":482,"date_added":483,"vulnerability_name":484,"short_description":485,"required_action":486,"due_date":487,"known_ransomware_campaign_use":488,"notes":489,"exploitation_type":9},"cisa","ScreenConnect","2026-09-11","ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability","ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.","Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","2026-09-14","Unknown","https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-84869",{"date":483,"score":447,"percentile":491},0.31639,[493,496,499],{"date":494,"score":447,"percentile":495},"2026-09-09",0.31599,{"date":497,"score":447,"percentile":498},"2026-09-10",0.31612,{"date":483,"score":447,"percentile":491},[501,506],{"source":451,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":502,"cvss_v4_0":9},{"baseScore":449,"baseSeverity":503,"vectorString":452,"impactScore":504,"exploitabilityScore":505},"CRITICAL",10,7.9,{"source":457,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":507,"cvss_v4_0":9},{"baseScore":449,"baseSeverity":503,"vectorString":452,"impactScore":504,"exploitabilityScore":505},[509],{"ecosystem":9,"name":482,"vendor":510,"product":511,"cpe_part":512,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":513},"connectwise","screenconnect","a",[514,519],{"version":515,"is_range":443,"range_type":516,"version_start":9,"version_start_type":9,"version_end":517,"version_end_type":518,"fixed_in":9},"lt26.6.5.9742","cpe","26.6.5.9742","excluding",{"version":520,"is_range":444,"range_type":451,"version_start":520,"version_start_type":521,"version_end":520,"version_end_type":521,"fixed_in":9},"All versions prior to 26.6.5","including"]