Vendor
ConnectWise
17 known vulnerabilities.
Products
5 results · Clear filters · Feed
-
Critical 9.9CVE-2026-84869 Exploited
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
KEV Sep 11, 2026 -
Critical 9.0
ScreenConnect Instance Level Cryptographic Material Exposure
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest cl…
-
Critical 9.1
Improper server-side validation in ScreenConnect extension framework
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavi…
-
Critical 9.6CVE-2025-11492 Public exploit
HTTP Configuration and Encryption in Transit
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the enc…
-
Critical 10.0
Authentication bypass using an alternate path or channel
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
KEV Feb 22, 2024