Known Vulnerabilities for products from ConnectWise
Listed below are 20 of the newest known vulnerabilities associated with the vendor "ConnectWise".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-84869 json | A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session witho... | Not Provided | 2026-09-08 | 2026-09-12 |
| CVE-2026-13374 json | Not Provided | 2026-07-03 | 2026-08-27 | |
| CVE-2026-11596 json | In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authe... | Not Provided | 2026-06-10 | 2026-10-26 |
| CVE-2026-9089 json | The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and sel... | Not Provided | 2026-05-21 | 2026-07-23 |
| CVE-2026-6066 json | ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate ... | Not Provided | 2026-04-20 | 2026-10-26 |
| CVE-2025-14265 json | In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem cou... | Not Provided | 2025-12-11 | 2026-10-07 |
| CVE-2025-13937 json | Not Provided | 2025-12-04 | 2026-08-10 | |
| CVE-2025-11493 json | The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, d... | Not Provided | 2025-10-16 | 2026-10-09 |
| CVE-2025-11492 json | In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path... | Not Provided | 2025-10-16 | 2026-10-09 |
| CVE-2024-1708 json | ConnectWise ScreenConnect 23.9.7 and prior are affected by path-traversal vulnerability, which may allow an attacker the ab... | Not Provided | 2024-02-21 | 2026-04-28 |
| CVE-2023-25719 json | ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as th... | 8.8 - HIGH | 2023-02-13 | 2023-03-05 |
| CVE-2023-25718 json | ** DISPUTED ** In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signe... | 9.8 - CRITICAL | 2023-02-13 | 2023-11-07 |
| CVE-2023-23130 json | ** DISPUTED ** Connectwise Automate 2022.11 is vulnerable to Cleartext authentication. Authentication is being done via HTTP ... | 5.9 - MEDIUM | 2023-02-01 | 2023-11-07 |
| CVE-2023-23128 json | ** DISPUTED **Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS). The vendor's positio... | 6.1 - MEDIUM | 2023-02-01 | 2023-11-07 |
| CVE-2023-23127 json | ** DISPUTED **In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing ... | 5.3 - MEDIUM | 2023-02-01 | 2023-11-07 |
| CVE-2023-23126 json | ** DISPUTED ** Connectwise Automate 2022.11 is vulnerable to Clickjacking. The login screen can be iframed and used to manipu... | 6.1 - MEDIUM | 2023-02-01 | 2023-11-07 |
| CVE-2022-36781 json | WiseConnect - ScreenConnect Session Code Bypass. An attacker would have to use a proxy to monitor the traffic, and perform a ... | 5.3 - MEDIUM | 2022-09-28 | 2024-03-14 |
| CVE-2021-35066 json | An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132. | 9.8 - CRITICAL | 2021-06-21 | 2021-06-28 |
| CVE-2021-32582 json | An issue was discovered in ConnectWise Automate before 2021.5. A blind SQL injection vulnerability exists in core agent inven... | 7.5 - HIGH | 2021-06-17 | 2021-06-22 |
| CVE-2020-15838 json | The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has we... | 8.8 - HIGH | 2020-10-09 | 2021-07-21 |
Known software with vulnerabilities from ConnectWise
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Connectwise | Automate | - |
| Application | Connectwise | Automate Api | 2019.12.337 |
| Application | Connectwise | Connectwise Automate | 2019.12 |
| Application | Connectwise | Control | 19.3.25270.7185 |
| Application | Connectwise | Manage | 2017.5 |