ConnectWise

Vulnerability activity for ConnectWise: what is being exploited, what was published lately, and when the next patch release is due.

All vendors Open in the dashboard

Last 30 days

CVEs: 0
Critical (CVSS 9+): 0
Exploited (CISA KEV): 0
With exploit code: 0

Last 90 days

CVEs: 1
Critical (CVSS 9+): 1
Exploited (CISA KEV): 1
With exploit code: 0

Last 365 days

CVEs: 9
Critical (CVSS 9+): 2
Exploited (CISA KEV): 2
With exploit code: 1

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

9.9CriticalSep 11, 2026ConnectWise ScreenConnect Privilege escalationCVE-2026-84869ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.Added to KEV Sep 11, 2026Exploited
8.4HighApr 28, 2026ConnectWise ScreenConnect Path traversal / file handlingCVE-2024-1708ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.Added to KEV Apr 28, 2026Exploited95% likelyExploit codeMetasploit · NucleiDetection
8.1HighApr 25, 2025ConnectWise ScreenConnect Auth bypass / access controlCVE-2025-3935ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.Added to KEV Jun 2, 2025 · 37 days after publicationExploited3.6% likely
10.0CriticalFeb 21, 2024ConnectWise ScreenConnect Auth bypass / access controlCVE-2024-1709ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.Added to KEV Feb 22, 2024 · same day as publicationExploited100% likelyExploit codeMetasploit · NucleiDetection

Recent

9.9CriticalSep 11, 2026ConnectWise ScreenConnect Privilege escalationCVE-2026-84869ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation.Exploited
4.7MediumJun 10, 2026Connectwise screenconnectCVE-2026-11596In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated access tokens.
8.8HighMay 21, 2026Connectwise automateCVE-2026-9089The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.
8.4HighApr 28, 2026ConnectWise ScreenConnect Path traversal / file handlingCVE-2024-1708ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.Exploited95% likelyExploit codeMetasploit · NucleiDetection
7.1HighApr 20, 2026Connectwise automate Information disclosureCVE-2026-6066ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑based interception of Solution Center traffic in Automate deployments. The issue has been resolved in Automate 2026.4 by enforcing secure communication for affected Solution Center connections.
6.5MediumJan 16, 2026Connectwise professional service automationCVE-2026-0696In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.
8.7HighJan 16, 2026Connectwise professional service automation XSSCVE-2026-0695In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser when the affected content is displayed.
5.3MediumDec 18, 2025Connectwise screenconnect Information disclosureCVE-2025-14823In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and securely stored at rest; however, an encrypted representation could be exposed in client responses. Updating the Certificate Signing Extension to version 1.0.12 or higher ensures configuration handling occurs exclusively
9.1CriticalDec 11, 2025Connectwise screenconnectCVE-2025-14265In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavior could result in the execution of custom code on the server or unauthorized access to application configuration data. This issue affects only the ScreenConnect server component; host and guest clients are not impacted. ScreenConnect 25.8 i
8.1HighApr 25, 2025ConnectWise ScreenConnect Auth bypass / access controlCVE-2025-3935ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.Exploited3.6% likely
10.0CriticalFeb 21, 2024ConnectWise ScreenConnect Auth bypass / access controlCVE-2024-1709ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.Exploited100% likelyExploit codeMetasploit · NucleiDetection

See every ConnectWise entry on the dashboard.