https://pwn.watch/t/screenconnect Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 11 Sep 2026 00:00:00 GMT https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869 https://pwn.watch/i/connectwise-screenconnect-cve-2026-84869 Fri, 11 Sep 2026 00:00:00 GMT high <p>ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host confirmation. Added to CISA KEV on 2026-09-11.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2026-09-11: CISA added CVE-2026-84869 to the KEV catalog (due 2026-09-14).</li></ul> <p><strong>CVEs:</strong> CVE-2026-84869</p> https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935 https://pwn.watch/i/connectwise-screenconnect-cve-2025-3935 Mon, 02 Jun 2025 00:00:00 GMT high <p>ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised. Added to CISA KEV on 2025-06-02.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2025-06-02: CISA added CVE-2025-3935 to the KEV catalog (due 2025-06-23).</li></ul> <p><strong>CVEs:</strong> CVE-2025-3935</p> https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709 https://pwn.watch/i/connectwise-screenconnect-auth-bypass-cve-2024-1709 Thu, 22 Feb 2024 00:00:00 GMT critical <p>ConnectWise ScreenConnect before 23.9.8 had a trivially exploitable authentication bypass (CVE-2024-1709, CVSS 10) and a path traversal (CVE-2024-1708), reported to ConnectWise on 2024-02-19. Attackers could create an admin account on self-hosted servers and then push code to every managed endpoint. Exploitation began within days, including by ransomware groups. Cloud instances were patched by ConnectWise; on-premise servers had to update to 23.9.8. Added to the CISA KEV catalog on 2024-02-22. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 23.9.8 (ConnectWise bulletin)</p> <p><strong>Latest updates:</strong></p><ul><li>2024-02-22: CISA added CVE-2024-1709 to the KEV catalog (federal deadline 2024-02-29) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-02-22: ConnectWise urges on-premise partners to update to 23.9.8 immediately (<a href="https://www.connectwise.com/company/trust/security-bulletins/connectwise-screenconnect-23.9.8">source</a>)</li><li>2024-02-21: CVE-2024-1709 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-1709">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2024-1709, CVE-2024-1708</p>