ConnectWise vulnerabilities
We track 13 vulnerabilities in ConnectWise products across 4 products. 13 are rated high or critical, and 5 have been exploited in real attacks. The most recent was published on September 8, 2026.
Latest ConnectWise vulnerabilities
- 9.9 Critical severity
ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Exploited
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
- 8.8 High severity
Automate: Download of Code Without Integrity Check
The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5.
- 7.1 High severity
Automate: Cleartext Transmission of Sensitive Information
ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow network‑ba
- 9.0 Critical severity
ScreenConnect: Improper Verification of Cryptographic Signature
A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and guest cli
- 9.1 Critical severity
ScreenConnect: Download of Code Without Integrity Check
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of this behavio
- 7.5 High severity
Automate: Download of Code Without Integrity Check
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and substitute ma
- 7.5 High severity
Automate: Cleartext Transmission of Sensitive Information
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally, the encr
- 7.2 High severity
ConnectWise ScreenConnect Improper Authentication Exploited
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note th
- 10.0 Critical severity
ConnectWise ScreenConnect Authentication Bypass Exploited
ConnectWise ScreenConnect 23.9.7 and prior are affected by an Authentication Bypass Using an Alternate Path or Channel vulnerability, which may allow an attacker direct access to confidential information or critical systems.
- 8.4 High severity
ConnectWise ScreenConnect Path Traversal Exploited
ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ability to execute remote code or directly impact confidential data or critical systems.
- 8.8 High severity
Control: Improper Neutralization of Special Elements in Output Used by a Downstream Component
ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter. This results in reflected data and injection of malicious code into a downloaded execu
- 9.8 Critical severity
Control: Improper Verification of Cryptographic Signature
In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the signature, such as instructions that result in offering the end user a (different) at
- 9.8 Critical severity
Kaseya VSA SQL Injection Exploited
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the wild to download and ex