ConnectWise

Latest CVEs · RSS

• CVE-2026-84869 2026-09-08 · CVSS 9.9
  A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmati
• CVE-2026-11596 2026-06-10 · CVSS 4.7
  In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation
• CVE-2026-9089 2026-05-21 · CVSS 8.8
  The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is ad
• CVE-2026-6066 2026-04-20 · CVSS 7.1
  ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-
• CVE-2026-3564 2026-03-17 · CVSS 9.0
  A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauth
• CVE-2026-0696 2026-01-16 · CVSS 6.5
  In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side
• CVE-2026-0695 2026-01-16 · CVSS 8.7
  In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain
• CVE-2025-14823 2025-12-18 · CVSS 5.3
  In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returne
• CVE-2025-14265 2025-12-11 · CVSS 9.1
  In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and executi
• CVE-2025-11493 2025-10-16 · CVSS 8.8
  The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This
• CVE-2025-11492 2025-10-16 · CVSS 9.6
  In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-mid
• CVE-2025-7204 2025-07-09 · CVSS 6.5
  In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API re
• CVE-2025-4876 2025-05-19 · CVSS 6.0
  ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering.
• CVE-2025-3935 2025-04-25 · CVSS 8.1
  ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and