https://www.phllaps.net/tags/connectwise/ Recent content in ConnectWise on PhllapsNET Hugo en-gb Fri, 11 Sep 2026 00:00:00 +0000 https://www.phllaps.net/posts/connectwise-screenconnect-improper-privilege-management-and-missing-authorization-vulnerability/ Fri, 11 Sep 2026 00:00:00 +0000 https://www.phllaps.net/posts/connectwise-screenconnect-improper-privilege-management-and-missing-authorization-vulnerability/ <div style="background:#b91c1c;color:white;padding:16px 18px;border-radius:14px;font-weight:800;font-size:18px;display:flex;align-items:center;gap:12px;box-shadow:0 10px 24px rgba(0,0,0,0.18);"><span style="font-size:24px;">🚨</span><span>SEVERITY: CRITICAL — CVSS 9.9</span><span style="opacity:0.95;font-weight:700;margin-left:auto;">Security Advisory</span></div> <h2 id="tldr-">TL;DR 📌</h2> <ul> <li>ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to file transfer and execution through an active remote sessions without authorization or host confirmation.</li> <li>Highest CVSS: <strong>9.9 (Critical)</strong>.</li> <li><strong>Listed in CISA KEV</strong> (2026-09-11) — this is being exploited in the wild.</li> <li><strong>Fixed in <code>26.6.5.9742</code></strong> — upgrade to this release or later.</li> <li>CVEs: CVE-2026-84869.</li> </ul> <h2 id="what-it-is">What it is</h2> <p>CVE-2026-84869 affects the ScreenConnect client, not the server component. ConnectWise describes it as a combination of improper privilege management and missing authorization: an active remote support session can be used to transfer and execute files without the host confirming or authorising that action first.</p>