Skip to content

Vendor

ConnectWise vulnerabilities

36 published CVES affecting ConnectWise, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
36
Critical
9
High
15
Medium
12
Low
0
Unscored
0
CISA KEV
5
Atom feed of ConnectWise alerts

Products

Latest ConnectWise CVEs

Newest publication first · page 1 of 2

  2. CVE-2026-11596 In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a tok...

    Published
    MediumCVSS 4.7

    In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum when generating delegated acc...

  5. CVE-2026-3564 ScreenConnect Instance Level Cryptographic Material Exposure

    Published
    CriticalCVSS 9.0

    A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest client agents are not i...

  6. CVE-2026-0696 Session Cookies Missing HttpOnly Attribute

    Published
    MediumCVSS 6.5

    In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values.

  7. CVE-2026-0695 Stored XSS in Time Entry Audit Trail

    Published
    MediumCVSS 5.4

    In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the context of a user’s browser whe...

  8. CVE-2025-14823 Certificate Signing Extension Returns Encrypted Values

    Published
    MediumCVSS 5.3

    In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The values remained encrypted and...

  11. CVE-2025-11492 HTTP Configuration and Encryption in Transit

    Published
    HighCVSS 7.5

    In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encryption method used t...

  12. CVE-2025-7204 Exposure of password hashes via API responses in ConnectWise PSA

    Published
    MediumCVSS 6.5

    In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted password hashes for other users. Aut...

  14. CVE-2025-3935 ScreenConnect Exposure to ASP.NET ViewState Code Injection

    Published
    HighCVSS 7.2 EPSS 3.6% CISA KEV added 2025-06-02 Exploited in the wild

    ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these m...

  15. CVE-2024-1709 Authentication bypass using an alternate path or channel

    Published
    CriticalCVSS 10.0 EPSS 100.0% CISA KEV added 2024-02-22 Ransomware Exploited in the wild Framework module PoC

    ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.

  19. CVE-2023-25719 ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected....

    Published
    HighCVSS 8.8

    ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded executable. The executabl...

  20. CVE-2023-25718 In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instru...

    Published
    CriticalCVSS 9.8

    In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) attacker-controlled ex...

  21. CVE-2022-36781 ConnectWise - ScreenConnect Session Code Bypass

    Published
    MediumCVSS 5.3

    ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default configuration. Attackers could exploit this vulnerability to gain unauthorized access by repea...

  23. CVE-2021-32582 An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database informat...

    Published
    HighCVSS 7.5

    An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable an attacker to extract database information or administrative credentials from an instance via crafted monitor status re...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.