https://vulnogram.org/ Most recent CVEs assigned by ConnectWise LLC (connectwise). https://vulnogram.org/seaview/icons/connectwise.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-84869 https://vulnogram.org/CVE-2026-84869 A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted. Critical Known Exploited Tue, 08 Sep 2026 19:29:33 GMT https://vulnogram.org/CVE-2026-11596 https://vulnogram.org/CVE-2026-11596 In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the ability to specify a token expiration duration beyond the intended maximum… Medium Wed, 10 Jun 2026 17:15:07 GMT https://vulnogram.org/CVE-2026-9089 https://vulnogram.org/CVE-2026-9089 The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations. This issue is addressed in Automate 2026.5. High Thu, 21 May 2026 14:32:14 GMT https://vulnogram.org/CVE-2026-6066 https://vulnogram.org/CVE-2026-6066 ConnectWise has released a security update for ConnectWise Automate™ that addresses a behavior in the ConnectWise Automate Solution Center where certain client-to-server communications could occur without transport-layer encryption. This could allow… High Mon, 20 Apr 2026 15:26:31 GMT https://vulnogram.org/CVE-2026-3564 https://vulnogram.org/CVE-2026-3564 A condition in the ScreenConnect server component may allow an actor with access to server-level cryptographic material used for authentication to obtain unauthorized access, including elevated privileges, in certain scenarios. ScreenConnect host and… Critical Network Exploitable Tue, 17 Mar 2026 14:48:59 GMT https://vulnogram.org/CVE-2026-0696 https://vulnogram.org/CVE-2026-0696 In ConnectWise PSA versions older than 2026.1, certain session cookies were not set with the HttpOnly attribute. In some scenarios, this could allow client-side scripts access to session cookie values. Medium Network Exploitable Fri, 16 Jan 2026 13:34:49 GMT https://vulnogram.org/CVE-2026-0695 https://vulnogram.org/CVE-2026-0695 In ConnectWise PSA versions older than 2026.1, Time Entry notes stored in the Time Entry Audit Trail may be rendered without applying output encoding to certain content. Under specific conditions, this may allow stored script code to execute in the c… High Fri, 16 Jan 2026 13:34:42 GMT https://vulnogram.org/CVE-2025-14823 https://vulnogram.org/CVE-2025-14823 In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to unauthenticated users through a client-facing endpoint under certain conditions. The… Medium Network Exploitable Thu, 18 Dec 2025 15:50:06 GMT https://vulnogram.org/CVE-2025-14265 https://vulnogram.org/CVE-2025-14265 In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users. Abuse of th… Critical Thu, 11 Dec 2025 14:21:53 GMT https://vulnogram.org/CVE-2025-11493 https://vulnogram.org/CVE-2025-11493 The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle attack and sub… High Thu, 16 Oct 2025 19:00:39 GMT https://vulnogram.org/CVE-2025-11492 https://vulnogram.org/CVE-2025-11492 In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic. Additionally… Critical Thu, 16 Oct 2025 18:59:35 GMT https://vulnogram.org/CVE-2025-7204 https://vulnogram.org/CVE-2025-7204 In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information. Specific API requests were found to return an overly verbose user object, which included encrypted passwo… Medium Wed, 09 Jul 2025 14:50:36 GMT https://vulnogram.org/CVE-2025-4876 https://vulnogram.org/CVE-2025-4876 ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering. This key is embedded in plaintext within the binary and used in cryptographic operations… Medium Mon, 19 May 2025 16:04:34 GMT https://vulnogram.org/CVE-2025-3935 https://vulnogram.org/CVE-2025-3935 ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important… High Known Exploited Network Exploitable Fri, 25 Apr 2025 18:27:44 GMT