CVE coverage
View on NVD →
CVE-2026-84869
CVSS 9.9
Actively exploited (KEV)
no coverage
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
Detection rules
No detection found — yet
None of Sigma, Elastic, Splunk ESCU, YARA, Microsoft Sentinel, Snort, or Suricata currently has a rule referencing CVE-2026-84869.
This CVE is on CISA's Known Exploited Vulnerabilities list. It is being exploited in the wild with no public detection rule — worth writing one.