ConnectWise ScreenConnect vulnerabilities

9 published CVEs name ConnectWise ScreenConnect among the affected products; CISA lists 4 of them as exploited in the wild.

Critical 4High 2Medium 3Low 0Not scored 0

CVEs per yearBy the year they were published

CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise · ScreenConnect
ExploitedCritical9.9
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
ConnectWise · ScreenConnect
ExploitedHigh8.4
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
ConnectWise · ScreenConnect
ExploitedHigh8.1
CVE-2024-1709
Authentication bypass using an alternate path or channel
ConnectWise · ScreenConnect
ExploitedCritical10.0

CVE-2026-84869
ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions
ConnectWise · ScreenConnect
ExploitedCritical9.9
CVE-2026-11596
In ScreenConnect™ versions prior to 26.2, input validation within the Host Pass creation functionality could allow an authenticated user with Host Pass…
ConnectWise · ScreenConnect
Medium4.7
CVE-2026-3564
ScreenConnect Instance Level Cryptographic Material Exposure
ConnectWise · ScreenConnect
Critical9.0
CVE-2025-14823
Certificate Signing Extension Returns Encrypted Values
ConnectWise · ScreenConnect
Medium5.3
CVE-2025-14265
Improper server-side validation in ScreenConnect extension framework
ConnectWise · ScreenConnect
Critical9.1
CVE-2025-3935
ScreenConnect Exposure to ASP.NET ViewState Code Injection
ConnectWise · ScreenConnect
ExploitedHigh8.1
CVE-2024-1709
Authentication bypass using an alternate path or channel
ConnectWise · ScreenConnect
ExploitedCritical10.0
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
ConnectWise · ScreenConnect
ExploitedHigh8.4
CVE-2022-36781
ConnectWise - ScreenConnect Session Code Bypass
ConnectWise · ScreenConnect
Medium5.3