Vendor

    ConnectWise

    40 known vulnerabilities in products by ConnectWise, 5 of them actively exploited (CISA KEV).

    Key figures

    40

    Vulnerabilities

    5

    Actively exploited (KEV)

    3

    Used by ransomware

    12

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in ConnectWise
    CriticalCVE-2024-1709

    Authentication bypass using an alternate path or channel

    In CISA KEVRansomware

    		10.0
    CriticalCVE-2017-18362

    Kaseya VSA SQL Injection Vulnerability

    In CISA KEVRansomware

    		9.8
    CriticalCVE-2024-1708

    Improper limitation of a pathname to a restricted directory (“path traversal”)

    In CISA KEVRansomware

    		8.4
    CriticalCVE-2025-3935

    ScreenConnect Exposure to ASP.NET ViewState Code Injection

    In CISA KEV

    		8.1
    CriticalCVE-2026-84869

    ScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions

    In CISA KEV

    		9.9
    HighCVE-2019-16514

    ConnectWise Control: Remote Code Execution

    		7.2
    MediumCVE-2019-16516

    ConnectWise Control: security vulnerability

    		5.3
    HighCVE-2020-14159

    ConnectWise Automate API: SQL Injection

    		8.8
    CriticalCVE-2020-15027

    ConnectWise Automate: Authentication Bypass

    		9.8
    CriticalCVE-2019-16517

    ConnectWise Control: security vulnerability

    		9.8
    CriticalCVE-2021-35066

    ConnectWise Automate: XML External Entity (XXE)

    		9.8
    HighCVE-2020-15838

    ConnectWise Automate: Privilege Escalation

    		8.8
    MediumCVE-2019-16515

    ConnectWise Control: security vulnerability

    		6.5
    HighCVE-2023-25719

    ConnectWise Control: Denial of Service

    		8.8
    HighCVE-2023-47257

    ConnectWise ScreenConnect: Remote Code Execution

    		8.1
    HighCVE-2019-16513

    ConnectWise Control: Cross-Site Request Forgery (CSRF)

    		8.8
    CriticalCVE-2023-25718

    ConnectWise Control: security vulnerability

    		9.8
    HighCVE-2021-32582

    Connectwise Automate: SQL Injection

    		7.5
    HighCVE-2020-15008

    Connectwise Automate: SQL Injection

    		7.5
    CriticalCVE-2025-14265

    Improper server-side validation in ScreenConnect extension framework

    		9.1
    CriticalCVE-2026-3564

    ScreenConnect Instance Level Cryptographic Material Exposure

    		9.0
    MediumCVE-2017-11727

    ConnectWise Manage: Cross-Site Scripting (XSS)

    		6.1
    HighCVE-2026-9089

    ConnectWise Automate: Download of Code Without Integrity Check

    		8.8
    MediumCVE-2019-16512

    ConnectWise Control: Cross-Site Scripting (XSS)

    		4.8
    CriticalCVE-2025-11492

    HTTP Configuration and Encryption in Transit

    		9.6

    All vulnerabilities in search

    News

    Products

    Products by ConnectWise
    ConnectWise Automate110
    ConnectWise ScreenConnect114
    Control80
    ConnectWise PSA30
    ConnectWise PSA30