---
cve: "CVE-2026-84869"
severity: "CRITICAL"
cvss: 9.9
epss: "0.9%"
vendor: "ConnectWise"
kev: true
exploited: true
published: "2026-09-08 20:18:51"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-08T18:18:47+01:00"
---

# CVE-2026-84869

> 9.9 CRITICAL · ⚠️ CISA KEV (57 Tage) · 🔓 Exploited · 🧪 PoC

## Beschreibung

A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.

## CNA-Record (Kanon, cvelistV5)

- CNA: **ConnectWise**
- State: PUBLISHED
- Stand: 2026-09-12 03:55:19
- CNA-CVSS: **9.9** (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA KEV seit: **11.09.2026**
- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **active**
  - Automatable: **no**
  - Technical Impact: **total**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Verändert | bad |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-269** — Improper Privilege Management
  The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
- **CWE-862** — Missing Authorization
  The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

## Angriffsmuster (CAPEC)

- [CAPEC-58 — Restful Privilege Elevation](https://capec.mitre.org/data/definitions/58.html) _(Severity: High)_
- [CAPEC-122 — Privilege Abuse](https://capec.mitre.org/data/definitions/122.html) _(Severity: Medium)_
- [CAPEC-233 — Privilege Escalation](https://capec.mitre.org/data/definitions/233.html)

## ATT&CK-Techniken

- [T1548 — Abuse Elevation Control Mechanism](https://attack.mitre.org/techniques/T1548/)

## BSI-Hinweise (deutsch)

- [ConnectWise ScreenConnect: Schwachstelle ermöglicht Codeausführung](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3256) — _BSI-Einstufung: hoch_
  Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in ConnectWise ScreenConnect ausnutzen, um Code auszuführen.

## Referenzen

- <https://www.connectwise.com/company/trust/security-bulletins/2026-09-08-screenconnect-bulletin>
- <https://github.com/ConnectWise-Advisories/Disclosures/tree/main/CVE-2026-84869>
- <https://www.connectwise.com/company/trust/advisories>
- <https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-84869>
- <https://www.huntress.com/blog/rogue-screenconnect-installations>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-84869/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_