Skip to content
Noroxi

connectwise records

39 published records for vendor connectwise.

Researcher profile

Entered KEV
5 · 12.8%
Weaponized
5 · 12.8%
Pre-auth RCE
1
With a fix record
10.3%
Median publish → KEV
38 days

Records by year

  1. 17
  2. 19
  3. 20
  4. 21
  5. 22
  6. 23
  7. 24
  8. 25
  9. 26

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

CWE

Attack profile

All records

39 records
  • CVE-2024-1709
    100Now

    Authentication bypass using an alternate path or channel

    CriticalCVSS 10.0KEVWeaponizedEPSS 100%

    connectwise · screenconnectFeb 21, 2024

  • CVE-2017-18362
    95Now

    ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct ac

    CriticalCVSS 9.8KEVWeaponizedEPSS 87%

    connectwise · manageditsyncFeb 5, 2019

  • CVE-2024-1708
    92Now

    Improper limitation of a pathname to a restricted directory (“path traversal”)

    HighCVSS 8.4KEVWeaponizedEPSS 95%

    connectwise · screenconnectFeb 21, 2024

  • CVE-2026-84869
    69This week

    ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

    CriticalCVSS 9.9KEVWeaponizedEPSS 1%

    connectwise · screenconnectSep 8, 2026

  • CVE-2025-3935
    59Plan

    ScreenConnect Exposure to ASP.NET ViewState Code Injection

    HighCVSS 7.2KEVWeaponizedEPSS 4%

    connectwise · screenconnectApr 25, 2025

  • CVE-2020-15027
    39Monitor

    ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series

    CriticalCVSS 9.8No exploitEPSS 1%

    connectwise · automateJul 16, 2020

  • CVE-2019-16517
    39Monitor

    An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.

    CriticalCVSS 9.8No exploitEPSS 1%

    connectwise · controlJan 23, 2020

  • CVE-2021-35066
    39Monitor

    An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132.

    CriticalCVSS 9.8No exploitEPSS 1%

    connectwise · automateJun 21, 2021

  • CVE-2023-25718
    39Monitor

    In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can

    CriticalCVSS 9.8No exploitEPSS 1%

    connectwise · controlFeb 13, 2023

  • CVE-2020-14159
    36Monitor

    By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications

    HighCVSS 8.8No exploitEPSS 2%

    connectwise · automate apiJun 15, 2020

  • CVE-2025-14265
    36Monitor

    Improper server-side validation in ScreenConnect extension framework

    CriticalCVSS 9.1No exploitEPSS 0%

    connectwise · screenconnectDec 11, 2025

  • CVE-2020-15838
    35Monitor

    The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions.

    HighCVSS 8.8No exploitEPSS 1%

    connectwise · automateOct 9, 2020

  • CVE-2023-25719
    35Monitor

    ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWi

    HighCVSS 8.8No exploitEPSS 1%

    connectwise · controlFeb 13, 2023

  • CVE-2019-16513
    35Monitor

    An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.

    HighCVSS 8.8No exploitEPSS 1%

    connectwise · controlJan 23, 2020

  • CVE-2017-11726
    35Monitor

    services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstr

    HighCVSS 8.8No exploitEPSS 0%

    connectwise · manageJul 31, 2017

  • CVE-2026-9089
    35Monitor

    The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operatio

    HighCVSS 8.8No exploitEPSS 0%

    connectwise · automateMay 21, 2026

  • CVE-2023-47257
    32Monitor

    ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.

    HighCVSS 8.1No exploitEPSS 1%

    connectwise · automateFeb 1, 2024

  • CVE-2021-32582
    30Monitor

    An issue was discovered in ConnectWise Automate before 2021.5.

    HighCVSS 7.5No exploitEPSS 1%

    connectwise · connectwise automateJun 17, 2021

  • CVE-2020-15008
    30Monitor

    A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12.

    HighCVSS 7.5No exploitEPSS 1%

    connectwise · connectwise automateJul 7, 2020

  • CVE-2025-11493
    30Monitor

    Self-Update Verification Mechanism Process in ConnectWise Automate

    HighCVSS 7.5No exploitEPSS 0%

    connectwise · automateOct 16, 2025

  • CVE-2025-11492
    30Monitor

    HTTP Configuration and Encryption in Transit

    HighCVSS 7.5Proof of conceptEPSS 0%

    connectwise · automateOct 16, 2025

  • CVE-2019-16514
    29Monitor

    An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.

    HighCVSS 7.2No exploitEPSS 4%

    connectwise · controlJan 23, 2020

  • CVE-2026-6066
    28Monitor

    Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center

    HighCVSS 7.1No exploitEPSS 0%

    connectwise · automateApr 20, 2026

  • CVE-2019-16516
    27Monitor

    An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.

    MediumCVSS 5.3Proof of conceptEPSS 19%

    connectwise · controlJan 23, 2020

  • CVE-2019-16515
    27Monitor

    An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185.

    MediumCVSS 6.5No exploitEPSS 2%

    connectwise · controlJan 23, 2020