en
ConnectWise is a global IT software company that provides technology for managed service providers and other IT solution providers. Its core business covers business management, service delivery, automation, remote access, cybersecurity, and data-related operations through a unified platform and partner ecosystem.
As of 09/20/2026, ConnectWise recorded 1 security vulnerabilities in the last 90 days across 1 products, including 1 rated High or above and 1 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, ScreenConnect had the most security vulnerabilities in the ConnectWise ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-84869ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | Exploitation statusKEV | FixYes | Affected productScreenConnect | Published09/08/2026 | SeverityCritical |
CVE-2026-11596 | Exploitation statusNot known exploited | FixYes | Affected productScreenConnect | Published06/10/2026 | SeverityMedium |
CVE-2026-9089 | Exploitation statusNot known exploited | FixYes | Affected productAutomate | Published05/21/2026 | SeverityHigh |
CVE-2026-6066Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center | Exploitation statusNot known exploited | FixYes | Affected productAutomate | Published04/20/2026 | SeverityHigh |
CVE-2026-3564ScreenConnect Instance Level Cryptographic Material Exposure | Exploitation statusNot known exploited | FixYes | Affected productScreenConnect | Published03/17/2026 | SeverityCritical |
CVE-2026-0696Session Cookies Missing HttpOnly Attribute | Exploitation statusNot known exploited | FixYes | Affected productPSA | Published01/16/2026 | SeverityMedium |
CVE-2026-0695Stored XSS in Time Entry Audit Trail | Exploitation statusNot known exploited | FixYes | Affected productPSA | Published01/16/2026 | SeverityHigh |
CVE-2025-14823Certificate Signing Extension Returns Encrypted Values | Exploitation statusNot known exploited | FixNot confirmed | Affected productScreenConnect | Published12/18/2025 | SeverityMedium |
CVE-2025-14265Improper server-side validation in ScreenConnect extension framework | Exploitation statusNot known exploited | FixYes | Affected productScreenConnect | Published12/11/2025 | SeverityCritical |
CVE-2025-11493Self-Update Verification Mechanism Process in ConnectWise Automate | Exploitation statusNot known exploited | FixYes | Affected productAutomate | Published10/16/2025 | SeverityHigh |
CVE-2025-11492HTTP Configuration and Encryption in Transit | Exploitation statusNot known exploited | FixYes | Affected productAutomate | Published10/16/2025 | SeverityCritical |
CVE-2025-7204Exposure of password hashes via API responses in ConnectWise PSA | Exploitation statusNot known exploited | FixYes | Affected productPSA | Published07/09/2025 | SeverityMedium |
CVE-2025-4876Hardcoded Key Revealed in ConnectWise Password Encryption Utility | Exploitation statusNot known exploited | FixYes | Affected productRisk Assessment | Published05/19/2025 | SeverityMedium |
CVE-2025-3935ScreenConnect Exposure to ASP.NET ViewState Code Injection | Exploitation statusKEV | FixYes | Affected productScreenConnect | Published04/25/2025 | SeverityHigh |
CVE-2024-1709Authentication bypass using an alternate path or channel | Exploitation statusKEV | FixYes | Affected productScreenConnect | Published02/21/2024 | SeverityCritical |
CVE-2024-1708Improper limitation of a pathname to a restricted directory (“path traversal”) | Exploitation statusKEV | FixYes | Affected productScreenConnect | Published02/21/2024 | SeverityHigh |
CVE-2023-47256 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/01/2024 | SeverityMedium |
CVE-2023-47257 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/01/2024 | SeverityHigh |
CVE-2023-25719 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published02/13/2023 | SeverityHigh |
CVE-2023-25718 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/13/2023 | SeverityUnknown |
CVE-2023-23127 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/01/2023 | SeverityUnknown |
CVE-2023-23128 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/01/2023 | SeverityMedium |
CVE-2023-23130 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/01/2023 | SeverityUnknown |
CVE-2023-23126 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published02/01/2023 | SeverityUnknown |
CVE-2022-36781ConnectWise - ScreenConnect Session Code Bypass | Exploitation statusNot confirmed | FixYes | Affected productScreenConnect | Published09/28/2022 | SeverityMedium |
CVE-2021-35066 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/21/2021 | SeverityUnknown |
CVE-2021-32582 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/17/2021 | SeverityUnknown |
CVE-2020-15838 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/09/2020 | SeverityUnknown |
CVE-2020-15027 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published07/16/2020 | SeverityUnknown |
CVE-2020-15008 | Exploitation statusNot confirmed | FixYes | Affected productNot confirmed | Published07/07/2020 | SeverityUnknown |
CVE-2020-14159 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/15/2020 | SeverityUnknown |
CVE-2019-16515 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2020 | SeverityUnknown |
CVE-2019-16516 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2020 | SeverityUnknown |
CVE-2019-16514 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2020 | SeverityUnknown |
CVE-2019-16517 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2020 | SeverityUnknown |
CVE-2019-16512 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2020 | SeverityUnknown |
CVE-2019-16513 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published01/23/2020 | SeverityUnknown |
CVE-2017-18362 | Exploitation statusKEV | FixNot confirmed | Affected productNot confirmed | Published02/05/2019 | SeverityCritical |
CVE-2017-11726 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/31/2017 | SeverityUnknown |
CVE-2017-11727 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published07/31/2017 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
