CO
Vendor
ConnectWise
44
CVEs
5
On KEV
0
New 30D
Products
SC10.0
ScreenConnect
Remote Access
19 CVEs4 on KEV0 new
MA9.8
Manageditsync
Connectwise
1 CVEs1 on KEV0 new
AU9.8
Automate
ConnectWise
11 CVEs0 on KEV0 new
PS6.5
Professional Service Automation
Connectwise
3 CVEs0 on KEV0 new
CO6.1
Connectwise
Connectwise
2 CVEs0 on KEV0 new
CA7.5
Connectwise Automate
Connectwise
2 CVEs0 on KEV0 new
MA8.8
Manage
Connectwise
2 CVEs0 on KEV0 new
PS6.5
PSA
ConnectWise
2 CVEs0 on KEV0 new
AA8.8
Automate Api
Connectwise
1 CVEs0 on KEV0 new
RA4.4
Risk Assessment
Connectwise
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-84869 In wildKEV | SC ScreenConnect ConnectWise | 9.9 | Sep 8 | ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions |
| CVE-2026-11596 | SC ScreenConnect ConnectWise | 4.7 | Jun 10 | In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass creation privileges the… |
| CVE-2026-9089 | AU Automate ConnectWise | 8.8 | May 21 | The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations |
| CVE-2026-6066 | AU Automate ConnectWise | 7.1 | Apr 20 | Unencrypted Client‑Server Communication in ConnectWise Automate™ Solution Center |
| CVE-2026-3564 | SC ScreenConnect ConnectWise | 9.0 | Mar 17 | ScreenConnect Instance Level Cryptographic Material Exposure |
| CVE-2026-0696 | PS PSA ConnectWise | 6.5 | Jan 16 | Session Cookies Missing HttpOnly Attribute |
| CVE-2026-0695 | PS PSA ConnectWise | 5.4 | Jan 16 | Stored XSS in Time Entry Audit Trail |
| CVE-2025-14823 | SC ScreenConnect ConnectWise | 5.3 | Dec 18 | In deployments using the ScreenConnect™ Certificate Signing Extension, encrypted configuration values including an Azure Key Vault-related key, could be returned to… |
| CVE-2025-14265 | SC ScreenConnect ConnectWise | 9.1 | Dec 11 | In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or… |
| CVE-2025-11493 | AU Automate Connectwise | 7.5 | Oct 16 | The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations |
| CVE-2025-11492 | AU Automate Connectwise | 7.5 | Oct 16 | In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS |
| CVE-2025-7204 | PS Professional Service Automation Connectwise | 6.5 | Jul 9 | In ConnectWise PSA versions older than 2025.9, a vulnerability exists where authenticated users could gain access to sensitive user information |
| CVE-2025-4876 | RA Risk Assessment Connectwise | 4.4 | May 19 | ConnectWise-Password-Encryption-Utility.exe in ConnectWise Risk Assessment allows an attacker to extract a hardcoded AES decryption key via reverse engineering |
| CVE-2025-3935 In wildKEV | SC ScreenConnect ConnectWise | 7.2 | Apr 25 | ScreenConnect Exposure to ASP.NET ViewState Code Injection |
| CVE-2024-1709 RansomwareIn wildKEV | SC ScreenConnect ConnectWise | 10.0 | Feb 21 | Authentication bypass using an alternate path or channel |
| CVE-2024-1708 RansomwareIn wildKEV | SC ScreenConnect ConnectWise | 8.4 | Feb 21 | Improper limitation of a pathname to a restricted directory (“path traversal”) |
| CVE-2023-47257 | SC ScreenConnect ConnectWise | 8.1 | Feb 1 | ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages |
| CVE-2023-47256 | SC ScreenConnect ConnectWise | 5.5 | Feb 1 | ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings |
| CVE-2023-25719 | SC ScreenConnect ConnectWise | 8.8 | Feb 13 | ConnectWise Control before 22.9.10032 (formerly known as ScreenConnect) fails to validate user-supplied parameters such as the Bin/ConnectWiseControl.Client.exe h parameter |
| CVE-2023-25718 | SC ScreenConnect ConnectWise | 9.8 | Feb 13 | In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions can be added without invalidating the… |
| CVE-2023-23130 | AU Automate Connectwise | 5.9 | Feb 1 | Connectwise Automate 2022.11 is vulnerable to Cleartext authentication |
| CVE-2023-23128 | CO Connectwise Connectwise | 6.1 | Feb 1 | Connectwise Control 22.8.10013.8329 is vulnerable to Cross Origin Resource Sharing (CORS) |
| CVE-2023-23127 | CO Connectwise Connectwise | 5.3 | Feb 1 | In Connectwise Control 22.8.10013.8329, the login page does not implement HSTS headers therefore not enforcing HTTPS |
| CVE-2023-23126 | AU Automate Connectwise | 6.1 | Feb 1 | Connectwise Automate 2022.11 is vulnerable to Clickjacking |
| CVE-2022-36781 | SC ScreenConnect ConnectWise | 5.3 | Sep 28 | ConnectWise ScreenConnect versions 22.6 and below contained a flaw allowing potential brute force attacks on custom access tokens due to inadequate rate-limiting controls in the… |
| CVE-2021-35066 | AU Automate Connectwise | 9.8 | Jun 21 | An XXE vulnerability exists in ConnectWise Automate before 2021.0.6.132 |
| CVE-2021-32582 | CA Connectwise Automate Connectwise | 7.5 | Jun 17 | An issue was discovered in ConnectWise Automate before 2021.5 |
| CVE-2020-15838 | AU Automate Connectwise | 8.8 | Oct 9 | The Agent Update System in ConnectWise Automate before 2020.8 allows Privilege Escalation because the _LTUPDATE folder has weak permissions |
| CVE-2020-15027 | AU Automate Connectwise | 9.8 | Jul 16 | ConnectWise Automate through 2020.x has insufficient validation on certain authentication paths, allowing authentication bypass via a series of attempts |
| CVE-2020-15008 | CA Connectwise Automate Connectwise | 7.5 | Jul 7 | A SQLi exists in the probe code of all Connectwise Automate versions before 2020.7 or 2019.12 |
| CVE-2020-14159 | AA Automate Api Connectwise | 8.8 | Jun 15 | By using an Automate API in ConnectWise Automate before 2020.5.178, a remote authenticated user could execute commands and/or modifications within an individual Automate instance… |
| CVE-2019-16517 | SC ScreenConnect ConnectWise | 9.8 | Jan 23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185 |
| CVE-2019-16516 | SC ScreenConnect ConnectWise | 5.3 | Jan 23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185 |
| CVE-2019-16515 | SC ScreenConnect ConnectWise | 6.5 | Jan 23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185 |
| CVE-2019-16514 | SC ScreenConnect ConnectWise | 7.2 | Jan 23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185 |
| CVE-2019-16513 | SC ScreenConnect ConnectWise | 8.8 | Jan 23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185 |
| CVE-2019-16512 | SC ScreenConnect ConnectWise | 4.8 | Jan 23 | An issue was discovered in ConnectWise Control (formerly known as ScreenConnect) 19.3.25270.7185 |
| CVE-2017-18362 RansomwareIn wildKEV | MA Manageditsync Connectwise | 9.8 | Feb 5 | Kaseya VSA SQL Injection Vulnerability |
| CVE-2017-11727 | MA Manage Connectwise | 6.1 | Jul 31 | services/system_io/actionprocessor/Contact.rails in ConnectWise Manage 2017.5 allows arbitrary client-side JavaScript code execution (involving a ContactCommon field) on victims… |
| CVE-2017-11726 | MA Manage Connectwise | 8.8 | Jul 31 | services/system_io/actionprocessor/System.rails in ConnectWise Manage 2017.5 is vulnerable to Cross-Site Request Forgery (CSRF), as demonstrated by changing an e-mail address… |