ConnectWise vulnerabilities

17 published CVEs name ConnectWise among the affected products; CISA lists 4 of them as exploited in the wild.

Critical 5High 6Medium 6Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise · ScreenConnect
ExploitedCritical9.9
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
ConnectWise · ScreenConnect
ExploitedHigh8.4
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
ConnectWise · ScreenConnect
ExploitedHigh8.1
CVE-2024-1709
Authentication bypass using an alternate path or channel
ConnectWise · ScreenConnect
ExploitedCritical10.0

CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise · ScreenConnect
ExploitedCritical9.9
CVE-2026-11596
In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass…
ConnectWise · ScreenConnect
Medium4.7
CVE-2026-9089
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is…
ConnectWise · Automate
High8.8
CVE-2026-6066
Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center
ConnectWise · Automate
High7.1
CVE-2026-3564
ScreenConnect Instance Level Cryptographic Material Exposure
ConnectWise · ScreenConnect
Critical9.0
CVE-2026-0696
Session Cookies Missing HttpOnly Attribute
ConnectWise · PSA
Medium6.5
CVE-2026-0695
Stored XSS in Time Entry Audit Trail
ConnectWise · PSA
High8.7
CVE-2025-14823
Certificate Signing Extension Returns Encrypted Values
ConnectWise · ScreenConnect
Medium5.3
CVE-2025-14265
Improper server-side validation in ScreenConnect extension framework
ConnectWise · ScreenConnect
Critical9.1
CVE-2025-11493
Self-Update Verification Mechanism Process in ConnectWise Automate
ConnectWise · Automate
High8.8