connectwise has 5 CVEs on record between 2019 and 2026. 1 was published in the last 90 days. The median CVSS is 9.6 (critical), with 4 rated critical. 40% have been exploited in the wild — well above the 1% corpus average, so connectwise flaws are worth patching on sight. Most affected products: automate (2), screenconnect (2), manageditsync (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 40% vs 1% corpus
- Median CVSS
- 9.6
- Publish → KEV
- —(2)
- Last 90 days
- 1 prev 0
Products
- automate 2
- screenconnect 2
- manageditsync 1
Worst active — by depth score
CVE-2017-18362Critical· 9.8ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database100CVE-2026-84869Critical· 9.9A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances80CVE-2025-11492Critical· 9.6In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS65CVE-2025-14265Critical· 9.1In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users…50CVE-2025-11493High· 8.8The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations48
connectwise vulnerabilities
CVEs affecting connectwise, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-84869Critical· 9.9CISA KEVPoCA condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circumstances. ScreenConnect servers are not impacted.
CVE-2025-14265Critical· 9.1In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users…
In versions of ScreenConnect™ prior to 25.8, server-side validation and integrity checks within the extension subsystem could allow the installation and execution of untrusted or arbitrary extensions by authorized or administrative users…
CVE-2025-11493High· 8.8The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations
The ConnectWise Automate Agent does not fully verify the authenticity of files downloaded from the server, such as updates, dependencies, and integrations. This creates a risk where an on-path attacker could perform a man-in-the-middle a…
CVE-2025-11492Critical· 9.6PoCIn the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS
In the ConnectWise Automate Agent, communications could be configured to use HTTP instead of HTTPS. In such cases, an on-path threat actor with a man-in-the-middle network position could intercept, modify, or replay agent-server traffic.…
CVE-2017-18362Critical· 9.8CISA KEVPoCConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database
ConnectWise ManagedITSync integration through 2017 for Kaseya VSA is vulnerable to unauthenticated remote commands that allow full direct access to the Kaseya VSA database. In February 2019, attackers have actively exploited this in the …