Screenconnect
CVE-2025-3935
HIGH
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A08:2025 - Software or Data Integrity Failures
ASVS 5.0
V1 - Encoding and Sanitization Safe deserialization, type allowlists
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | High risk (CVSS 8.1, EPSS 15.5%). While requiring machine key compromise, this is the second major ScreenConnect vulnerability in a year. Machine keys may be obtained through other vulnerabilities, backup exposure, or configuration leaks. |
| Exploit ScenarioDerived | An attacker obtains ScreenConnect's machine keys through a separate vulnerability or configuration leak. They craft a signed ViewState payload containing a .NET deserialization gadget that executes OS commands when processed by the ScreenConnect server. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
ConnectWise ScreenConnect 25.2.3 and earlier may be susceptible to ViewState code injection when machine keys are compromised, enabling remote code execution through ASP.NET deserialization.
Earlier versions of this analysis (1)
A ViewState code injection in ScreenConnect allows attackers with access to ASP.NET machine keys to achieve remote code execution through crafted deserialization payloads.
RemediationAI
Update ScreenConnect. Regenerate machine keys. Restrict access to ScreenConnect configuration files. Monitor for unusual ASP.NET deserialization activity.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The CWE-502 deserialization vulnerability requires knowledge of the machine keys used for ViewState MAC validation. With the keys, attackers craft serialized .NET payloads signed as valid ViewState data for server-side execution.
Know when Screenconnect gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained.
If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server.
The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.
Executive ViewAI
CVE-2025-3935 presents notable security risk, a insecure deserialization vulnerability rated CVSS 8.1. Insecure deserialization could allow attackers to execute arbitrary code by providing crafted serialized data. This vulnerability is actively exploited in the wild (KEV-listed) and requires immediate remediation. Immediate patching is required per CISA KEV mandate.
Apply vendor patch. If immediate patching is not feasible: (1) Restrict deserialization endpoints; (2) Implement integrity checks on serialized data; (3) Use type-safe alternatives.
Threat Intelligence Overview
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Insecure deserialization occurs when an application converts serialized data (a stream of bytes representing an object's state) back into a living object without proper validation.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Affected Products (CPE)CVE.org
More in Screenconnect
View allPath traversal in ConnectWise ScreenConnect 23.9.7 and earlier enables attackers with administrative privileges to write
Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a p
Integrity-check and server-side validation weaknesses in the ConnectWise ScreenConnect server's extension subsystem allo
A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom acce
ScreenConnect versions prior to 26.2 permit an authenticated user holding Host Pass creation privileges to bypass the in
GitHub PoC
Exploit-DB