{"type":"bundle","id":"bundle--6b8c3752-8f2a-5cff-87c7-ce2eba72d949","objects":[{"type":"identity","spec_version":"2.1","id":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-01-01T00:00:00.000Z","modified":"2026-01-01T00:00:00.000Z","name":"CTI-Hermes Autonomous Agent","identity_class":"organization"},{"type":"vulnerability","spec_version":"2.1","id":"vulnerability--bab0242b-b705-5cbc-b0d9-ea29891e709f","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:01.098551Z","modified":"2026-09-24T19:51:01.098551Z","name":"CVE-2026-84869","description":"A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.","external_references":[{"source_name":"cve","external_id":"CVE-2026-84869","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84869"}]},{"type":"attack-pattern","spec_version":"2.1","id":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:01.098551Z","modified":"2026-09-24T19:51:01.098551Z","name":"Exploit Public-Facing Application","external_references":[{"source_name":"mitre-attack","external_id":"T1190","url":"https://attack.mitre.org/techniques/T1190/"}]},{"type":"relationship","spec_version":"2.1","id":"relationship--ce7367ed-8337-594d-8abb-b8f85574fd65","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:01.098551Z","modified":"2026-09-24T19:51:01.098551Z","relationship_type":"targets","source_ref":"attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","target_ref":"vulnerability--bab0242b-b705-5cbc-b0d9-ea29891e709f"},{"type":"report","spec_version":"2.1","id":"report--6678b0a1-24f5-5c9d-abf9-fed04cd72932","created_by_ref":"identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","created":"2026-09-24T19:51:01.098551Z","modified":"2026-10-30T14:11:15.232552Z","name":"ConnectWise ScreenConnect CVE-2026-84869 exploited in the wild","description":"CISA lists CVE-2026-84869, a vulnerability in ConnectWise ScreenConnect, in the Known Exploited Vulnerabilities catalog (added 2026-09-11, due 2026-09-14), and NVD records a CVSS of 9.9. This report summarizes public CTI only.","published":"2026-09-24T19:51:01.098551Z","report_types":["threat-report"],"object_refs":["identity--f431f809-377b-45e0-aa1c-6a4751cae5ff","vulnerability--bab0242b-b705-5cbc-b0d9-ea29891e709f","attack-pattern--9ffe8e3a-6780-5277-ad7f-618967ae1f09","relationship--ce7367ed-8337-594d-8abb-b8f85574fd65"],"confidence":90}]}