CVE-2026-11596 | Medium | 4.7 | 2026-06-10 | In ScreenConnect™ versions prior to 26.2, input
validation within the Host Pass creation functionality could allow an
authenticated user with Host Pass creatio… |
CVE-2026-9089 | High | 8.8 | 2026-05-21 | The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is a… |
CVE-2026-6066 | High | 7.1 | 2026-04-20 | ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client… |
CVE-2026-3564 | Critical | 9.0 | 2026-03-17 | A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unaut… |
CVE-2026-0696 | Medium | 6.5 | 2026-01-16 | In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-sid… |
CVE-2026-0695 | High | 8.7 | 2026-01-16 | In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certai… |
CVE-2025-14823 | Medium | 5.3 | 2025-12-18 | In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be return… |
CVE-2025-14265 | Critical | 9.1 | 2025-12-11 | In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execut… |
CVE-2025-11493 | High | 8.8 | 2025-10-16 | The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. Thi… |
CVE-2025-11492 | Critical | 9.6 | 2025-10-16 | In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-mi… |
CVE-2025-7204 | Medium | 6.5 | 2025-07-09 | In ConnectWise PSA versions older than 2025.9, a
vulnerability exists where authenticated users could gain access to sensitive
user information. Specific API r… |
CVE-2025-4876 | Medium | 6.0 | 2025-05-19 | ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering… |
CVE-2025-3935 | High | 8.1 | 2025-04-25 | ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page an… |
CVE-2024-1709 | Critical | 10.0 | 2024-02-21 | ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel
vulnerability, which may allow an atta… |
CVE-2024-1708 | High | 8.4 | 2024-02-21 | ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker
the ability to execute remote code or di… |
CVE-2023-47257 | High | 8.1 | 2024-02-01 | ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages. |
CVE-2023-47256 | Medium | 5.5 | 2024-02-01 | ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings |
CVE-2023-25719 | High | 8.8 | 2023-02-13 | ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.ex… |
CVE-2023-25718 | Critical | 9.8 | 2023-02-13 | In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without i… |
CVE-2023-23130 | Medium | 5.9 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP (cleartext) with SSL disabled. OTE: the vendor's… |
CVE-2023-23128 | Medium | 6.1 | 2023-02-01 | Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's position is that two endpoints have Access-Control-Allo… |
CVE-2023-23127 | Medium | 5.3 | 2023-02-01 | In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS. NOTE: the vendor's position is that, by d… |
CVE-2023-23126 | Medium | 6.1 | 2023-02-01 | Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipulate users to perform unintended actions. NOTE: t… |
CVE-2022-36781 | Medium | 5.3 | 2022-09-28 | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiti… |
CVE-2021-35066 | Critical | 9.8 | 2021-06-21 | An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. |
CVE-2021-32582 | High | 7.5 | 2021-06-17 | An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inventory communication that can enable… |
CVE-2020-15838 | High | 8.8 | 2020-10-09 | The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions. |
CVE-2020-15027 | Critical | 9.8 | 2020-07-16 | ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts. This… |
CVE-2020-15008 | High | 7.5 | 2020-07-07 | A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A SQL Injection in the probe implementation to save data to a cu… |
CVE-2020-14159 | High | 8.8 | 2020-06-15 | By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individua… |
CVE-2019-16517 | Critical | 9.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a CORS misconfiguration, which reflected the Origin… |
CVE-2019-16516 | Medium | 5.3 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauth… |
CVE-2019-16515 | Medium | 6.5 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. Certain HTTP security headers are not used. |
CVE-2019-16514 | High | 7.2 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. The server allows remote code execution. Administrative users… |
CVE-2019-16513 | High | 8.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. CSRF can be used to send API requests. |
CVE-2019-16512 | Medium | 4.8 | 2020-01-23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is stored XSS in the Appearance modifier. |
CVE-2017-18362 | Critical | 9.8 | 2019-02-05 | ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya… |
CVE-2017-11727 | Medium | 6.1 | 2017-07-31 | services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution (involving a ContactCommon… |
CVE-2017-11726 | High | 8.8 | 2017-07-31 | services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an… |