Known exploited vulnerabilities
ConnectWise vulnerabilities attackers have used
Every ConnectWise vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.
The short answer
CISA lists 4 ConnectWise vulnerabilities as exploited in the wild, 2 of them added in the last 12 months and 2 used in ransomware campaigns. The most recent is CVE-2026-84869, added Sep 11, 2026. ScreenConnect has the most entries (4).
- In KEV, all time
- 4
- Added, last 12 months
- 2
- Used in ransomware
- 2
- New CVEs this week
- 0
Every ConnectWise entry in CISA KEV
CVE-2026-84869
Added · dueConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability
ConnectWise ScreenConnect contains both an improper privilege management and missing authorization vulnerability that may allow an attacker to transfer and execute files through an active remote session without authorization or host…
ConnectWise ScreenConnect Path Traversal Vulnerability
ConnectWise ScreenConnect contains a path traversal vulnerability which could allow an attacker to execute remote code or directly impact confidential data and critical systems.
CVE-2025-3935
Added · dueConnectWise ScreenConnect Improper Authentication Vulnerability
ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.
ConnectWise ScreenConnect Authentication Bypass Vulnerability
ConnectWise ScreenConnect contains an authentication bypass vulnerability that allows an attacker with network access to the management interface to create a new, administrator-level account on affected devices.
Related
Know the day a CVE lands in your code
Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.