Today’s Topics:

• ScreenConnect Flaw Turns a Trusted Remote Session Into a File Execution Path
• Cisco ISE Zero-Day Turns an Identity Control Point Into Root Access
• How can Netizen help?

---

ScreenConnect Flaw Turns a Trusted Remote Session Into a File Execution Path

Remote support software already occupies an unusually trusted position inside an enterprise. A technician can connect to endpoints, transfer files, interact with desktops, and perform administrative work from a single console. CVE-2026-84869 shows what can happen when the authorization checks surrounding those capabilities fail.

ConnectWise disclosed the vulnerability on September 8, 2026, alongside the release of ScreenConnect 26.6.5. The flaw affects ScreenConnect versions prior to 26.6.5 and exists in the ScreenConnect client rather than the server. Under certain conditions, files can be transferred and executed through an active remote session without the authorization or Host confirmation that would normally control those actions. ConnectWise classified the issue as Priority 1 and assigned it a CVSS 3.1 score of 9.9.

The CVSS vector explains why the flaw received a score just below the maximum. Exploitation can occur over a network, requires low privileges, has low attack complexity, and requires no interaction from the user on the affected endpoint. Successful exploitation can have high confidentiality, integrity, and availability impact. The changed-scope component is equally significant: activity initiated through one security context can affect the remote host on the other side of the ScreenConnect session.

That distinction matters. CVE-2026-84869 is not a vulnerability that lets an unauthenticated attacker scan the internet and immediately compromise every ScreenConnect server they find. An active remote session is part of the attack path, and some level of privilege is required. The issue becomes dangerous once an attacker gains access to the session context needed to reach the vulnerable functionality. From there, a capability meant for legitimate remote administration can become a path for unauthorized file delivery and execution.

CISA added CVE-2026-84869 to its Known Exploited Vulnerabilities Catalog on September 11 after receiving evidence of active exploitation. The agency listed September 14 as the remediation date for affected federal systems covered by its current vulnerability-management directive. CISA’s inclusion of the flaw moves it beyond theoretical severity: attackers are using the vulnerability against real systems. Public information does not currently establish a single threat group, malware family, or ransomware operation responsible for that exploitation.

ScreenConnect is particularly valuable from an attacker’s perspective since remote-management software already has many of the capabilities an intrusion operator normally has to build or deploy. Legitimate administrators need remote desktop access, unattended endpoint access, file transfer, scripting, and software execution. If attackers can misuse those same mechanisms, their activity can travel through tooling an organization intentionally installed and trusted.

This creates a different defensive problem from detecting an unknown remote-access trojan. A malicious executable appearing on a workstation may immediately attract endpoint attention. A legitimate management client carrying out file activity can be harder to judge without context. The security question shifts from whether ScreenConnect ran to who initiated the session, what permissions that identity should have had, what was transferred, where the file originated, and what executed after the transfer.

CVE-2026-84869 also exposes why authorization controls inside remote-management products matter as much as authentication at the front door. Multi-factor authentication, credential protection, and account monitoring can make account takeover more difficult, but they cannot compensate for a sensitive action that fails to check whether an authenticated session is permitted to perform it. ConnectWise classified the issue under both missing authorization and improper privilege management, reflecting that separation between gaining access to a session and being allowed to perform a privileged operation inside it.

ConnectWise patched the behavior in ScreenConnect 26.6.5 by changing client and session handling around file-transfer and file-execution actions. Cloud customers receive the server-side update through the hosted service, but ConnectWise directs customers to reinstall Host clients and update Access agents after the upgrade. On-premises customers need to install version 26.6.5 or later. Systems running older clients remain part of the exposure that administrators need to address.

Organizations that cannot patch an on-premises deployment immediately have a temporary option. ConnectWise recommends reviewing ScreenConnect roles and removing the TransferFiles permission from each applicable session group. The company states that this measure only reduces exposure and does not replace the security update. That distinction is worth retaining during emergency change windows: limiting file transfer closes part of the reachable functionality, but the supported fix is still the updated client behavior.

Defenders should also treat the disclosure as a reason to examine ScreenConnect activity retrospectively rather than stopping at version inventory. CISA’s KEV listing confirms exploitation has occurred. Organizations with exposed or heavily used ScreenConnect environments can review session history, technician identities, unusual access times, unexpected file transfers, processes launched shortly after remote sessions, and endpoint telemetry tied to ScreenConnect client activity. The value comes from correlating management-plane records with endpoint and network data rather than treating any single log source as complete.

CVE-2026-84869 is a useful example of a broader problem surrounding remote administration. Security teams often focus on preventing attackers from deploying their own tools. Modern intrusions do not always require that step. If an attacker can acquire access to a trusted management platform and reach a weak authorization boundary inside it, the organization may already provide much of the remote execution infrastructure the attacker needs.

For ScreenConnect customers, the immediate response is direct: move affected deployments to 26.6.5 or later, refresh the relevant clients and agents, and review recent remote-session activity for signs of misuse. The longer-term lesson reaches beyond one product. Remote-management systems sit close to the endpoints they administer and often carry privileges that few other applications possess. Their internal authorization boundaries deserve the same scrutiny organizations place on identity providers, privileged-access systems, and other administrative control planes.

---

Cisco ISE Zero-Day Turns an Identity Control Point Into Root Access

Cisco Identity Services Engine exists to make access decisions. It helps organizations determine which users and devices can connect, apply policy, and control access across enterprise networks. A newly disclosed zero-day creates the opposite situation: an unauthenticated attacker can bypass authentication to the platform itself and, after successful exploitation, potentially reach root-level command execution.

Cisco disclosed CVE-2026-76460 on September 16, 2026. The vulnerability affects Cisco ISE and Cisco ISE Passive Identity Connector deployments regardless of configuration. Cisco assigned the flaw a CVSS 3.1 score of 10.0, with network-based exploitation, low attack complexity, no required privileges, and no user interaction. The advisory supplied with the research material confirms the same affected-product scope and maximum base score.

The vulnerability stems from insufficient authentication control on an API endpoint. According to Cisco, an attacker can send a crafted request to an affected endpoint and bypass the web-based management interface. That alone would make the issue serious for a network-access-control platform. Cisco’s incident-response guidance raises the potential impact further: successful exploitation can give the attacker command execution with root privileges.

Cisco has confirmed active exploitation. CISA added CVE-2026-76460 to its Known Exploited Vulnerabilities Catalog on September 16, setting September 19 as the remediation date for affected federal assets covered by its directive. The vulnerability was not uncovered through a routine researcher submission. Cisco states that it found the issue during work on a Technical Assistance Center support case, a detail that fits with exploitation having already occurred before public disclosure.

ISE is a high-value target for reasons that extend beyond the appliance itself. The platform can sit at the center of enterprise authentication and network-access policy, integrating with switches, wireless infrastructure, identity stores, endpoint posture systems, and administrative workflows. Compromise of such a system places an attacker inside a management layer that organizations use to decide which systems should be trusted in the first place.

That makes CVE-2026-76460 different from a vulnerability affecting a less privileged application server. An attacker reaching root on ISE gains control of the underlying device at the same point defenders rely on it for identity and policy enforcement. Cisco warns that an attacker with this level of access may remove or conceal evidence of exploitation. Local logs on a compromised node cannot automatically be treated as a complete record of what occurred.

Cisco has published a practical starting point for compromise assessment. Administrators can review the ISE Kong API gateway access log for suspicious usernames and repeat that review across every node in a distributed deployment. Cisco also recommends collecting the wider API gateway logs through a support bundle for further investigation. Entries involving unexpected usernames may indicate attempted exploitation, though the vendor makes clear that the example it provides is not an exhaustive indicator.

The harder part begins after suspected exploitation. Root access gives an intruder the ability to interfere with the same local telemetry investigators would normally use to reconstruct the incident. Cisco tells administrators to cross-check logs that reside outside the affected appliance, including firewall and network records, for suspicious connections, unexpected uploads from the ISE system, or downloads from malicious infrastructure. If malicious activity is suspected, Cisco recommends re-imaging affected nodes and restoring configuration from backup rather than trusting the existing installation.

That guidance demonstrates a core incident-response principle for privileged infrastructure. Once an attacker has reached the highest operating-system privilege level, remediation becomes a trust problem rather than a simple malware-removal problem. Investigators need telemetry that the compromised system could not alter and a recovery process that returns the appliance to a known state.

Cisco says there is no workaround that resolves CVE-2026-76460. Administrators can use infrastructure access control lists to restrict management and control-plane traffic destined for affected devices, which can reduce opportunities for remote exploitation. Cisco still treats that step as a mitigation rather than a fix.

The fixed versions depend on the ISE branch in use. Cisco lists 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4 as the first releases containing the correction. ISE 3.0 has already reached the end of software maintenance, so deployments on that branch need to move to a supported release containing the fix.

The timing of CVE-2026-76460 also places it inside a much larger September security release for ISE. Cisco published a hardening package addressing multiple vulnerability classes across ISE and ISE-PIC, including input-validation, privilege-management, authorization, injection, and related security issues. Cisco states that the authentication bypass is the flaw from that group known to be under active exploitation.

For organizations running ISE, patching is only one part of the response. Systems that were reachable before the update merit log review and compromise assessment, especially given the confirmed exploitation and possibility of root access. Management interfaces should also be reachable only from systems and network segments that have a legitimate administrative need to contact them.

---

How Can Netizen Help?

Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally. 

Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.

Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.

Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.

---