Screenconnect
Monthly
Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a party to an active remote session push and run files on the Host machine without authorization or the Host's confirmation under certain circumstances. This turns a legitimate support session into a code-execution channel against the remote endpoint; ScreenConnect servers are explicitly not affected. No public exploit identified at time of analysis, though the client's remote-support role makes it an attractive target.
A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access to server-level cryptographic material to authenticate as any user and obtain elevated privileges. The vulnerability affects all ScreenConnect versions prior to 26.1 and carries a CVSS score of 9.0, indicating critical severity. While not currently listed in CISA's KEV catalog and with no public proof-of-concept available, the vulnerability's authentication bypass nature and potential for complete system compromise make it a high-priority patching target.
ConnectWise ScreenConnect 25.2.3 and earlier may be susceptible to ViewState code injection when machine keys are compromised, enabling remote code execution through ASP.NET deserialization.
Path traversal in ConnectWise ScreenConnect 23.9.7 and earlier enables attackers with administrative privileges to write files outside intended directories, leading to remote code execution or direct compromise of confidential data and critical systems. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 53.66% (98th percentile) reflects extremely high real-world exploitation activity. It was disclosed alongside the more severe CVE-2024-1709 authentication bypass, which together formed a widely abused exploit chain against ScreenConnect on-premises servers in early 2024.
ScreenConnect versions prior to 26.2 permit an authenticated user holding Host Pass creation privileges to bypass the intended maximum token expiration duration when generating delegated access tokens. The root cause is improper input validation (CWE-1284) on the duration field in the Host Pass workflow, allowing the value to exceed its designed upper bound. While no public exploit or CISA KEV listing exists at time of analysis, successful abuse results in the creation of anomalously long-lived access tokens, extending delegated access well beyond the security policy limit - a persistence and access-control integrity risk.
Integrity-check and server-side validation weaknesses in the ConnectWise ScreenConnect server's extension subsystem allow a user who already holds administrative or otherwise authorized server access to install and execute untrusted or arbitrary extensions on versions prior to 25.8, resulting in custom code execution on the server and unauthorized access to application configuration data. The flaw rates 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), but because the attacker must already be able to install extensions, this is a post-authentication, high-privilege code-integrity abuse rather than anonymous remote exploitation, and it affects only the server component - host and guest clients are explicitly not impacted. No public exploit code has been identified and active exploitation is not confirmed, with EPSS at just 0.37% (29th percentile), so the realistic risk comes from malicious or compromised privileged accounts rather than opportunistic internet scanning.
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthorized file transfer and execution in the ConnectWise ScreenConnect client (all versions prior to 26.6.5) lets a party to an active remote session push and run files on the Host machine without authorization or the Host's confirmation under certain circumstances. This turns a legitimate support session into a code-execution channel against the remote endpoint; ScreenConnect servers are explicitly not affected. No public exploit identified at time of analysis, though the client's remote-support role makes it an attractive target.
A cryptographic authentication bypass vulnerability in ConnectWise ScreenConnect allows remote attackers who gain access to server-level cryptographic material to authenticate as any user and obtain elevated privileges. The vulnerability affects all ScreenConnect versions prior to 26.1 and carries a CVSS score of 9.0, indicating critical severity. While not currently listed in CISA's KEV catalog and with no public proof-of-concept available, the vulnerability's authentication bypass nature and potential for complete system compromise make it a high-priority patching target.
ConnectWise ScreenConnect 25.2.3 and earlier may be susceptible to ViewState code injection when machine keys are compromised, enabling remote code execution through ASP.NET deserialization.
Path traversal in ConnectWise ScreenConnect 23.9.7 and earlier enables attackers with administrative privileges to write files outside intended directories, leading to remote code execution or direct compromise of confidential data and critical systems. This vulnerability is confirmed actively exploited (CISA KEV) with publicly available exploit code, and the EPSS score of 53.66% (98th percentile) reflects extremely high real-world exploitation activity. It was disclosed alongside the more severe CVE-2024-1709 authentication bypass, which together formed a widely abused exploit chain against ScreenConnect on-premises servers in early 2024.
ScreenConnect versions prior to 26.2 permit an authenticated user holding Host Pass creation privileges to bypass the intended maximum token expiration duration when generating delegated access tokens. The root cause is improper input validation (CWE-1284) on the duration field in the Host Pass workflow, allowing the value to exceed its designed upper bound. While no public exploit or CISA KEV listing exists at time of analysis, successful abuse results in the creation of anomalously long-lived access tokens, extending delegated access well beyond the security policy limit - a persistence and access-control integrity risk.
Integrity-check and server-side validation weaknesses in the ConnectWise ScreenConnect server's extension subsystem allow a user who already holds administrative or otherwise authorized server access to install and execute untrusted or arbitrary extensions on versions prior to 25.8, resulting in custom code execution on the server and unauthorized access to application configuration data. The flaw rates 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), but because the attacker must already be able to install extensions, this is a post-authentication, high-privilege code-integrity abuse rather than anonymous remote exploitation, and it affects only the server component - host and guest clients are explicitly not impacted. No public exploit code has been identified and active exploitation is not confirmed, with EPSS at just 0.37% (29th percentile), so the realistic risk comes from malicious or compromised privileged accounts rather than opportunistic internet scanning.
ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the default. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.