Connectwise: >> Screenconnect >> 25.8.0.9438 Security Vulnerabilities
CVE-2026-84869
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Known exploited
CVSS Score
9.9
EPSS Score
0.009
Published
2026-09-08
In ScreenConnect™ versions prior to 26.2, input
validation within the Host Pass creation functionality could allow an
authenticated user with Host Pass creation privileges the ability to specify a
token expiration duration beyond the intended maximum when generating delegated
access tokens.
CVSS Score
4.7
EPSS Score
0.002
Published
2026-06-10