ConnectWise

Products

Exploited and recent CVEs

• CVE-2026-84869 Critical 9.9 Exploited ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions 0.9%
• CVE-2025-3935 High 8.1 Exploited ScreenConnect Exposure to ASP.NET ViewState Code Injection 3.6%
• CVE-2024-1709 Critical 10.0 Exploited Authentication bypass using an alternate path or channel 100.0%
• CVE-2024-1708 High 8.4 Exploited Improper limitation of a pathname to a restricted directory (“path traversal”) 95.4%
• CVE-2026-11596 Medium 4.7 In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a tok 0.2%
• CVE-2026-9089 High 8.8 The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5. 0.3%
• CVE-2026-6066 High 7.1 Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center <0.1%
• CVE-2026-3564 Critical 9.0 ScreenConnect Instance Level Cryptographic Material Exposure 0.4%
• CVE-2026-0696 Medium 6.5 Session Cookies Missing HttpOnly Attribute 0.4%
• CVE-2026-0695 High 8.7 Stored XSS in Time Entry Audit Trail 0.3%
• CVE-2025-14823 Medium 5.3 Certificate Signing Extension Returns Encrypted Values 0.2%
• CVE-2025-14265 Critical 9.1 Improper server-side validation in ScreenConnect extension framework 0.4%
• CVE-2025-11493 High 8.8 Self-Update Verification Mechanism Process in ConnectWise Automate 0.2%
• CVE-2025-11492 Critical 9.6 HTTP Configuration and Encryption in Transit 0.2%
• CVE-2025-7204 Medium 6.5 Exposure of password hashes via API responses in ConnectWise PSA 0.4%
• CVE-2025-4876 Medium 6.0 Hardcoded Key Revealed in ConnectWise Password Encryption Utility 0.1%
• CVE-2022-36781 Medium 5.3 ConnectWise - ScreenConnect Session Code Bypass 0.6%