CVE-2019-16516

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....

5.3 MediumPublic exploit

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185. There is a user enumeration vulnerability, allowing an unauthenticated attacker to determine with certainty if an account exists for a given username.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: None
Availability: None

Exploit likelihood

19.1%Up 17.8 points since Apr 14, 2021

What each source reports

NVD Score used 5.3

Record: CVE-2019-16516
CVSS 3.1: 5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-203
Updated: 2026-11-02

CVE List No score

Record: CVE-2019-16516
Updated: 2026-11-02

EUVDEUVD-2019-7193 No score

Record: EUVD-2019-7193
Updated: 2026-11-03

GitHub AdvisoriesGHSA-j4v4-83w4-ph37 No score

An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....

Record: GHSA-j4v4-83w4-ph37
Weakness: CWE-200, CWE-203
Updated: 2026-11-02

Affected products

connectwise control

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	ConnectWise Control 19.2.24707 - Username Enumeration	2022-01-05
PoC in GitHub	czz/ScreenConnect-UserEnum	2021-12-17

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2019-16516 is a medium vulnerability (CVSS 5.3) in Connectwise Control, published January 23, 2020. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.1%, the 97th percentile. No source names a fixed version.