ConnectWise ScreenConnect
9 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-84869 | All versions prior to 26.6.5 | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions | CRITICAL 9.9 | 0.9 % | KEV | |
| CVE-2026-11596 | All versions prior to 26.2 | In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user wit | MEDIUM 4.7 | 0.2 % | ||
| CVE-2026-3564 | All server versions prior to 26.1 | ScreenConnect Instance Level Cryptographic Material Exposure | CRITICAL 9.0 | 0.4 % | ||
| CVE-2025-14823 | ScreenConnect (all supported versions) when used with the Certificate Signing Extension versions prior to 1.0.12 | Certificate Signing Extension Returns Encrypted Values | MEDIUM 5.3 | 0.2 % | ||
| CVE-2025-14265 | All versions prior to 2025.8 | Improper server-side validation in ScreenConnect extension framework | CRITICAL 9.1 | 0.4 % | ||
| CVE-2025-3935 | <25.2.3 | ScreenConnect Exposure to ASP.NET ViewState Code Injection | HIGH 8.1 | 3.6 % | KEV | |
| CVE-2024-1709 | ≤ 23.9.7 | Authentication bypass using an alternate path or channel | CRITICAL 10.0 | 100 % | KEV | |
| CVE-2024-1708 | ≤ 23.9.7 | Improper limitation of a pathname to a restricted directory (“path traversal”) | HIGH 8.4 | 95 % | KEV | |
| CVE-2022-36781 | 22.7 – < 22.6* | ConnectWise - ScreenConnect Session Code Bypass | MEDIUM 5.3 | 0.6 % |