Skip to content
Connectwise vulnerabilities
Newest
-
connectwise screenconnect
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
CVE-2026-84869
In KEV
9.9 Critical
-
connectwise screenconnect
In ScreenConnect™ versions prior to 26.2, input
validation within the Host Pass creation...
CVE-2026-11596
4.7 Medium
-
connectwise automate
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained...
CVE-2026-9089
8.8 High
-
connectwise automate
Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center
CVE-2026-6066
7.1 High
-
connectwise screenconnect
ScreenConnect Instance Level Cryptographic Material Exposure
CVE-2026-3564
9.0 Critical
-
connectwise psa, professional service automation +1 more
Session Cookies Missing HttpOnly Attribute
CVE-2026-0696
6.5 Medium
-
connectwise psa, professional service automation +1 more
Stored XSS in Time Entry Audit Trail
CVE-2026-0695
8.7 High
-
connectwise screenconnect
Certificate Signing Extension Returns Encrypted Values
CVE-2025-14823
5.3 Medium
-
connectwise screenconnect
Improper server-side validation in ScreenConnect extension framework
CVE-2025-14265
9.1 Critical
-
connectwise automate
Self-Update Verification Mechanism Process in ConnectWise Automate
CVE-2025-11493
8.8 High
-
connectwise automate
HTTP Configuration and Encryption in Transit
CVE-2025-11492
Public exploit
9.6 Critical
-
connectwise psa, professional service automation +1 more
Exposure of password hashes via API responses in ConnectWise PSA
CVE-2025-7204
6.5 Medium
-
connectwise risk assessment
Hardcoded Key Revealed in ConnectWise Password Encryption Utility
CVE-2025-4876
6.0 Medium
-
connectwise screenconnect
ScreenConnect Exposure to ASP.NET ViewState Code Injection
CVE-2025-3935
In KEV
8.1 High
-
connectwise screenconnect
Authentication bypass using an alternate path or channel
CVE-2024-1709
In KEVPublic exploit
EPSS 100.0%
10.0 Critical
-
connectwise screenconnect
Improper limitation of a pathname to a restricted directory (“path traversal”)
CVE-2024-1708
In KEVPublic exploit
EPSS 95.4%
8.4 High
-
connectwise screenconnect, automate +1 more
ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote...
CVE-2023-47257
8.1 High
-
connectwise screenconnect, automate +1 more
ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers...
CVE-2023-47256
5.5 Medium
-
connectwise control
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user...
CVE-2023-25719
8.8 High
-
connectwise control
The cryptographic code signing process and controls on ConnectWise Control through 22.9.10032 ...
CVE-2023-25718
9.8 Critical
-
connectwise automate
Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being...
CVE-2023-23130
Disputed
5.9 Medium
-
connectwise
Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS).
CVE-2023-23128
Disputed
6.1 Medium
-
connectwise
In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore...
CVE-2023-23127
Disputed
5.3 Medium
-
connectwise automate
Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and...
CVE-2023-23126
Disputed
6.1 Medium
-
connectwise screenconnect
ConnectWise - ScreenConnect Session Code Bypass
CVE-2022-36781
5.3 Medium
-
connectwise automate
An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.
CVE-2021-35066
9.8 Critical
-
connectwise automate
An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection...
CVE-2021-32582
7.5 High
-
connectwise automate
The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because...
CVE-2020-15838
8.8 High
-
connectwise automate
ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths,...
CVE-2020-15027
9.8 Critical
-
connectwise automate
A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12. A...
CVE-2020-15008
7.5 High
-
connectwise automate api
By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user...
CVE-2020-14159
8.8 High
-
connectwise control
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....
CVE-2019-16515
6.5 Medium
-
connectwise control
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....
CVE-2019-16516
Public exploit
EPSS 19.1%
5.3 Medium
-
connectwise control
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....
CVE-2019-16514
7.2 High
-
connectwise control
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....
CVE-2019-16517
9.8 Critical
-
connectwise control
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....
CVE-2019-16512
4.8 Medium
-
connectwise control
An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185....
CVE-2019-16513
8.8 High
-
connectwise manageditsync, kaseya virtual system/server administrator (vsa) +1 more
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to...
CVE-2017-18362
In KEV
EPSS 86.8%
9.8 Critical
-
connectwise manage
services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary...
CVE-2017-11727
6.1 Medium
-
connectwise manage
services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to...
CVE-2017-11726
8.8 High