Connectwise vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Exploited Connectwise flaws

These are on CISA’s Known Exploited Vulnerabilities list, newest first. If you run any of these products, these come before everything else.

• CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing AuthorizationExploited since Sep 11, 2026 · CVSS 9.9
• CVE-2024-1708 ConnectWise ScreenConnect Path TraversalExploited since Apr 28, 2026 · ransomware · CVSS 8.4
• CVE-2025-3935 ConnectWise ScreenConnect Improper AuthenticationExploited since Jun 2, 2025 · CVSS 8.1
• CVE-2024-1709 ConnectWise ScreenConnect Authentication BypassExploited since Feb 22, 2024 · ransomware · CVSS 10

Latest high and critical flaws

• CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing AuthorizationExploited · Critical 9.9 · Sep 8, 2026
• CVE-2026-9089 The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations.High 8.8 · May 21, 2026
• CVE-2026-6066 ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-High 7.1 · Apr 20, 2026
• CVE-2026-3564 A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthCritical 9 · Mar 17, 2026
• CVE-2026-0695 In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certainHigh 8.7 · Jan 16, 2026
• CVE-2025-14265 In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and executiCritical 9.1 · Dec 11, 2025
• CVE-2025-11493 The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations.High 8.8 · Oct 16, 2025
• CVE-2025-11492 In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS.Critical 9.6 · Oct 16, 2025
• CVE-2025-3935 ConnectWise ScreenConnect Improper AuthenticationExploited · High 8.1 · Apr 25, 2025
• CVE-2024-1709 ConnectWise ScreenConnect Authentication BypassExploited · Critical 10 · Feb 21, 2024
• CVE-2024-1708 ConnectWise ScreenConnect Path TraversalExploited · High 8.4 · Feb 21, 2024
• CVE-2023-47257 ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.High 8.1 · Feb 1, 2024
• CVE-2023-25719 ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exeHigh 8.8 · Feb 13, 2023
• CVE-2023-25718 In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without inCritical 9.8 · Feb 13, 2023
• CVE-2021-35066 An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.Critical 9.8 · Jun 21, 2021
• CVE-2021-32582 An issue was discovered in ConnectWise Automate before 2021.5.High 7.5 · Jun 17, 2021
• CVE-2020-15838 The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.High 8.8 · Oct 9, 2020
• CVE-2020-15027 ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts.Critical 9.8 · Jul 16, 2020
• CVE-2020-15008 A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12.High 7.5 · Jul 7, 2020
• CVE-2020-14159 By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individualHigh 8.8 · Jun 15, 2020
• CVE-2019-16517 An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.Critical 9.8 · Jan 23, 2020
• CVE-2019-16514 An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.High 7.2 · Jan 23, 2020
• CVE-2019-16513 An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.High 8.8 · Jan 23, 2020
• CVE-2017-11726 services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an High 8.8 · Jul 31, 2017