{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T16:23:59.585Z",
  "tag": {
    "id": "screenconnect",
    "label": "ScreenConnect",
    "isStack": false,
    "url": "https://pwn.watch/t/screenconnect",
    "feed": "https://pwn.watch/t/screenconnect/feed.xml"
  },
  "counts": {
    "incidents": 3,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 3
  },
  "incidents": [
    {
      "slug": "connectwise-screenconnect-cve-2026-84869",
      "title": "ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869",
      "json": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "ConnectWise ScreenConnect",
      "tags": [
        "connectwise",
        "screenconnect",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-84869"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-11",
      "closedAt": "2026-09-11",
      "updatedAt": "2026-09-11",
      "summary": "ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11.",
      "xPost": null
    },
    {
      "slug": "connectwise-screenconnect-cve-2025-3935",
      "title": "ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability",
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935",
      "json": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "ConnectWise ScreenConnect",
      "tags": [
        "connectwise",
        "screenconnect",
        "cisa-kev",
        "rce",
        "auth-bypass"
      ],
      "cveIds": [
        "CVE-2025-3935"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-06-02",
      "closedAt": "2025-06-02",
      "updatedAt": "2025-06-02",
      "summary": "ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.",
      "xPost": null
    },
    {
      "slug": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "title": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "json": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "ConnectWise ScreenConnect",
      "tags": [
        "connectwise",
        "screenconnect",
        "auth-bypass",
        "remote-access",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-1709",
        "CVE-2024-1708"
      ],
      "affectedVersions": [
        "ScreenConnect 23.9.7 and earlier (ConnectWise bulletin)"
      ],
      "fixedVersions": [
        "23.9.8 (ConnectWise bulletin)"
      ],
      "startedAt": "2024-02-19",
      "closedAt": "2024-02-22",
      "updatedAt": "2024-02-22",
      "summary": "ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "connectwise-screenconnect-cve-2026-84869",
      "incidentTitle": "ConnectWise ScreenConnect: ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-11",
      "title": "CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869"
    },
    {
      "incident": "connectwise-screenconnect-cve-2025-3935",
      "incidentTitle": "ConnectWise ScreenConnect: ScreenConnect Improper Authentication Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-06-02",
      "title": "CISA added CVE-2025-3935 to the KEV catalog (due 2025-06-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-22",
      "title": "CISA added CVE-2024-1709 to the KEV catalog (federal deadline 2024-02-29)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-22",
      "title": "ConnectWise urges on-premise partners to update to 23.9.8 immediately",
      "body": null,
      "sourceUrl": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-21",
      "title": "CVE-2024-1709 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1709",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-21",
      "title": "CVE-2024-1708 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-1708",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    },
    {
      "incident": "connectwise-screenconnect-auth-bypass-cve-2024-1709",
      "incidentTitle": "ConnectWise ScreenConnect auth bypass mass-exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-02-19",
      "title": "Both vulnerabilities reported to ConnectWise; cloud instances remediated",
      "body": null,
      "sourceUrl": "https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8",
      "url": "https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709"
    }
  ]
}