bleeping-computer Sep 16, 2026 · Crawled Sep 16, 2026

Critical ScreenConnect flaw now actively exploited in attacks

1 Actors

AI Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has warned of active exploitation of a critical-severity vulnerability in ConnectWise ScreenConnect, tracked as CVE-2026-84869. The flaw, which stems from improper privilege management and missing authorization, allows attackers with basic privileges to transfer or execute files during active remote sessions without requiring user interaction. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies to remediate it within three days. Over 1,000 unpatched instances remain exposed globally, primarily in North America and Europe, posing significant risks to federal and enterprise networks.

AI-extracted · verify before operational use

Extracted Entities 1 found

Threat Actor Kimsuky →

MITRE ATT&CK TTPs 8 techniques

T1027 Obfuscated Files or Information · Defense Evasion T1053.005 Scheduled Task · Execution T1059.001 PowerShell · Execution T1069.001 Local Groups · Discovery T1071.003 Mail Protocols · Command And Control T1082 System Information Discovery · Discovery T1204.002 Malicious File · Execution T1566 Phishing · Initial Access