ConnectWise ScreenConnect Vulnerabilities: 21 CVEs, 4 on CISA’s Exploited List, and a 799-Day Gap

As of November 5, 2026, NVD lists 21 ConnectWise ScreenConnect vulnerabilities, and CISA’s KEV catalog holds 4 of them, most recently CVE-2026-84869 (CVSS 9.9), listed September 11, three days after ConnectWise’s bulletin. On-premises servers need 26.6.5 or later. ConnectWise patched cloud servers itself, but that fix still tells partners to reinstall host clients and update access agents.

Figure 1. Every ScreenConnect fix since November 2023, and what CISA did next

Dots: ConnectWise bulletin date (or GitHub record for CVE-2026-11596). Red: KEV add date from the CISA catalog, version 2026.11.04. The pale segment on CVE-2026-84869 is the September 3 advisory that came before any patch.

The four exploited flaws: bulletin, patch, KEV

Only 4 of the 21 CVEs are on CISA’s list, yet the gap between ConnectWise’s bulletin and the KEV entry runs from 3 days to 799. The federal fix window has also moved: 7 days for CVE-2024-1709 in February 2024, 14 days for CVE-2024-1708 in April 2026, and 3 days for CVE-2026-84869, which CISA listed under Binding Operational Directive 26-04 (June 10, 2026). The deadline binds federal civilian agencies only, but it is a useful yardstick for an MSP change window.

Figure 2. How long until CISA listed it, and how long agencies then had (log scale, days)

Counted from ConnectWise’s bulletin date. Our RMM and remote access study counts from NVD publication, which gives 1, 797, 38 and 3 days for the same four CVEs. The comparison with other remote tools lives there.

What changed in 2026

ScreenConnect has 3 new CVEs so far in 2026, the same as all of 2025 (3). The order below is newest first.

CVE-2026-84869 (CVSS 9.9, in KEV). On September 3, ConnectWise posted a Guest File Transfer Advisory with a mitigation and no patch: deselect the TransferFiles permission (TransferFilesInSession on older builds) in every role. The September 8 bulletin shipped 26.6.5 and named the CVE. It rated the flaw Important, Priority 1, even with a 9.9 score. CISA listed it on September 11 with a September 14 due date. NVD’s record for the CVE cites a Huntress post describing rogue ScreenConnect clients, first placed by social engineering in late August, that spawned wscript.exe to run 1.vbs through 4.vbs and passed the same files to newly connected endpoints. Huntress calls that worm-like and is the source for it; ConnectWise’s bulletin says only that the details are too sensitive to share. The CVE sits in the client, and ConnectWise states that servers are not impacted, which is why upgrading the server is not the last step.

CVE-2026-11596 (CVSS 4.7). A Host Pass token could outlive its limit. ConnectWise fixed it in 26.2, released April 29, then published the CVE on June 10, a 42 day gap. It appears only in ConnectWise’s GitHub advisory repository: we found no entry for it in the Trust Center bulletin RSS feed or index. Anyone watching only the feed would not have seen it.

CVE-2026-3564 (CVSS 9.0, not in KEV). The March 17 bulletin says earlier versions stored per-instance machine keys in server configuration files, and 26.1 moves them to encrypted storage. The matching advisory says researchers have seen attempts to abuse disclosed ASP.NET machine key material and adds on-demand key regeneration. NVD still shows this record as Awaiting Analysis as of our pull, so the only score is ConnectWise’s.

Every ConnectWise ScreenConnect bulletin, dated

These are the 10 ScreenConnect and Control bulletins in ConnectWise’s Trust Center RSS feed, plus the one GitHub-only record from 2026. A phishing notice from July 2020 is in the same feed and is left out because it describes no product flaw.

Bulletins from 2020 and 2021 name a CWE but no CVE. Eleven CVEs have no bulletin at all: the six 2020 records from researcher reports, CVE-2022-36781, and CVE-2023-23127, 23128, 25718 and 25719.

Filter every CVE

All 21 CVEs from NVD, joined to KEV and ConnectWise’s rating. Red rows are in KEV. Scores use ConnectWise’s own when it is the CVE numbering authority and NVD’s otherwise. The two differ on CVE-2025-3935, which ConnectWise scores 8.1 and NIST scores 7.2.

SlashAndGrab: CVE-2024-1709 and CVE-2024-1708

ConnectWise’s bulletin says the two flaws were reported on February 13, 2024. Its own account says the report was validated on February 14 and all cloud instances were mitigated within 48 hours, without a version update. The on-premises package and bulletin followed on February 19, when the bulletin said there was no evidence of exploitation. Third parties published proofs of concept on February 21, CISA listed CVE-2024-1709 on February 22, and that same day ConnectWise began suspending on-premises instances below 23.9.8. Some pages give February 13 as the disclosure date or February 21 as the patch date. Both conflict with ConnectWise’s timeline.

Huntress gave the pair the name SlashAndGrab and says its researchers had a working exploit in under two hours. ConnectWise then made an exception for partners off maintenance: version 22.4.20001 at no cost, as an interim step. The bulletin’s wording is not consistent on what that build covers. Its February 23 and February 27 updates say it fixes CVE-2024-1709, while one FAQ line says it fixes both vulnerabilities. ConnectWise names 23.9.8 as the minimum version for both.

That matters because CVE-2024-1708 did not reach KEV until April 28, 2026, 799 days after the bulletin and with the ransomware flag set to Known. CISA does not say why it chose that date. The NVD record now cites a Microsoft report from April 6, 2026 that lists both CVEs among those exploited by Storm-1175 in Medusa ransomware operations, published 22 days before the listing. A client still on the 22.4 interim build should not be treated as clear of CVE-2024-1708.

CVE-2025-3935 and the 2025 nation-state notice

The order of events is checkable; the link between them is not. On April 24, 2025, ConnectWise released 25.2.4, which disables ViewState. On May 28, it published a Security Event Advisory saying suspicious activity in its environment, which it believes was tied to a sophisticated nation state actor, affected a very small number of ScreenConnect customers, with Mandiant investigating. CISA added CVE-2025-3935 on June 2, 5 days after the notice and 39 days after the bulletin.

ConnectWise’s FAQ does not answer its own question on whether the compromise was due to a ScreenConnect vulnerability. It does say the activity was not ransomware, is unrelated to the 2024 flaw, and that it saw no further suspicious activity in cloud instances after the April 24 patch. The CVE record adds that the risk comes from platform behavior rather than a flaw introduced by ScreenConnect, and that getting the machine keys requires privileged system-level access. NIST scored that same CVE 7.2 with high privileges required, against ConnectWise’s 8.1 with none. On June 9, 2025, a separate code signing certificate notice gave on-premises partners until June 13 to update, and ConnectWise says it was unrelated to the May event.

Cloud versus on-premises: who patches what

Figure 3. Who ConnectWise says must act on each fix since November 2023

Taken from the Remediation section of each bulletin or GitHub record. Cloud means screenconnect.com and hostedrmm.com, per ConnectWise.

ConnectWise’s wording is consistent for servers: cloud partners take no server action, and on-premises partners must upgrade. The exceptions are about clients. In November 2023 the cloud fix was a rolling update that admins could force, and guest clients needed updating. For CVE-2026-84869 the cloud section reads “No action is required” and then immediately tells partners to reinstall host clients and update access agents. The December 2025 25.8 patch names guest clients for on-premises only.

On-premises partners also face a licensing gate that has tightened. In February 2024, ConnectWise first said it had removed license restrictions, then clarified on February 27 that partners off maintenance could reach 22.4.20001 or a later eligible version, while 23.9.8 required active maintenance. In April 2025, it released free patches back to 23.9, identified by a publish date of April 22, 2025 or later. The bulletins for 25.8, 26.1 and 26.6.5 instead say a license out of maintenance must be upgraded before installing. The 26.6.5 FAQ does add that a renewal due in 2026 qualifies for 26.6 without renewing. Automate-integrated on-premises servers get 26.6.5 through Automate Product Updates, and only while the Automate Assurance subscription is active.

ConnectWise’s priority tracks exploitation better than CVSS

Figure 4. CVSS score by ConnectWise bulletin priority

Of the 5 Priority 1 ScreenConnect bulletins since 2023, 3 produced a KEV entry. None of the 2 Priority 2 bulletins did, and neither did any of the 12 CVEs with no bulletin. CVSS is a weaker signal: 2 of the 6 CVEs scoring 9.0 or higher are in KEV, and 2 of the 4 KEV entries score below 9.0. CVE-2025-14265 scored 9.1 with Priority 2 and has not been listed. With only 4 KEV entries this is a small sample, so treat it as a pattern to watch, not a rule. Our KEV catalog analysis covers the wider picture.

One bulletin needs care. The December 18, 2025 bulletin prints a CVSS score of 5.3 next to a vector, AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, that does not produce 5.3. The CVE record for CVE-2025-14823 carries a different vector, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, which does. We use the CVE record.

Which version to be on today

Use 26.6.5 or later on-premises. NVD’s configuration for CVE-2026-84869 ends at 26.6.5.9742. ConnectWise’s release notes page still showed 26.6.3.9722 as the stable release on the day we checked, below the version its own bulletin requires, so follow the bulletin. Version 26.7 was cloud canary with on-premises pending. A server must already be on 25.4 or later to upgrade directly to 26.6.5, and the Administration, then Overview page shows your Latest Eligible Version. Separately, the Certificate Signing Extension needs 1.0.12 or later, whatever the server version.

What this means for MSPs

Make Priority 1 the trigger. Every KEV-listed ScreenConnect CVE came from a Priority 1 bulletin, and two of the four reached KEV within 3 days of the bulletin. If your on-premises change process needs longer than the 3 day federal window that CVE-2026-84869 carried, write down the interim step in advance. For that flaw it was removing TransferFiles from each role, which will also block file transfer for those roles, so warn the service desk first.

Do not close the ticket at the server. For CVE-2026-84869, cloud and on-premises both need host clients reinstalled and access agents updated. Add an agent version report to the change, and check it per client tenant.

Watch three sources, not one. The bulletin RSS feed missed CVE-2026-11596, which appears on GitHub, and the September 3 notice lived on the Advisories page, 5 days ahead of the bulletin. Monitor the bulletin feed, the Advisories page and the GitHub repository, which ConnectWise calls the primary public reference for its CVEs.

Audit licenses before the next emergency. Since the 25.8 patch, bulletins say a license out of maintenance must be upgraded before installing the fix, and none offers the free back-ported route seen in 2024 and 2025. List every on-premises server with its Latest Eligible Version now. Any client below 25.4 needs a planned stepped upgrade, since ConnectWise’s April 2025 path ran 22.8 to 23.3 to 25.2.4, more than one hop.

Look for compromise as well as patching. For the 2024 flaws, ConnectWise says a compromised User.xml in App_Data holds only one new user, and its Report Manager extension exports host connections and queued commands. For 2026, Huntress says RunFiles or RanFiles audit entries showing the suspect scripts from Process: Guest should be treated as suspicious. If a server was exposed before 26.1, we suggest using the regeneration option ConnectWise added, since an upgrade alone does not tell you whether the old keys were taken. That last step is our judgment, not ConnectWise’s instruction.

Check the 22.4 and 23.9 stragglers. A 22.4.20001 server has ConnectWise’s interim fix for CVE-2024-1709, but the bulletin is inconsistent on CVE-2024-1708, which now carries a Known ransomware flag. Move those servers to a version ConnectWise names as fixed. How the same exposure compares across VPN appliances is on our VPN vulnerabilities scorecard.

Frequently asked questions

How secure is ScreenConnect?

NVD lists 21 ScreenConnect CVEs through November 5, 2026, and CISA has 4 of them on its Known Exploited Vulnerabilities list, about 1 in 5. Cloud servers are patched by ConnectWise. On-premises servers must be on 26.6.5 or later to clear every CVE with a stated version range. CISA listed two of the four, CVE-2024-1709 and CVE-2026-84869, within 3 days of the bulletin.

What are the top 5 ScreenConnect vulnerabilities by severity?

By CVSS score: CVE-2024-1709 (10.0); CVE-2026-84869 (9.9); CVE-2019-16517 (9.8); CVE-2023-25718 (9.8); CVE-2025-14265 (9.1). Only 2 of those 5 are in CISA KEV: CVE-2024-1709 and CVE-2026-84869. Two KEV entries, CVE-2024-1708 (8.4) and CVE-2025-3935 (8.1), score below all five.

What can hackers do with ScreenConnect?

CISA says CVE-2024-1709 lets an attacker with network access to the management interface create a new administrator-level account. CVE-2026-84869 may allow files to be transferred and executed through an active session without authorization or Host confirmation. Microsoft’s April 6, 2026 report also lists ScreenConnect among the remote tools Storm-1175 uses to stay in a compromised network.

How secure is ConnectWise itself?

On May 28, 2025, ConnectWise said suspicious activity in its environment, which it believes was tied to a sophisticated nation state actor, affected a very small number of ScreenConnect customers. It said it found no further suspicious activity in cloud instances after the April 24, 2025 patch, and it did not give a customer count.

What ScreenConnect version should I be on?

26.6.5 or later as of November 5, 2026. That is the lowest version ConnectWise names as fixing CVE-2026-84869. Servers must be on 25.4 or later to upgrade directly, and the release shows as eligible only under a license that covers it. Version 26.7 was still in cloud canary and pending for on-premises when we checked.

Are ScreenConnect cloud instances affected?

ConnectWise stated no server action for cloud partners on all 8 ScreenConnect fixes since November 2023, though the November 2023 fix rolled out over time. In 2 of those 8 it also named client steps for cloud, most recently reinstalling host clients and updating access agents for CVE-2026-84869.

Methodology

References

1. ConnectWise, Security Bulletins and RSS feed. Accessed November 2026.
2. ConnectWise, 2026-09-08 ScreenConnect Bulletin. Accessed November 2026.
3. ConnectWise, ScreenConnect 26.1 Security Hardening. Accessed November 2026.
4. ConnectWise, Certificate Signing Extension 1.0.12 Security Update. Accessed November 2026.
5. ConnectWise, ScreenConnect 25.8 Security Patch. Accessed November 2026.
6. ConnectWise, ScreenConnect 25.2.4 Security Patch. Accessed November 2026.
7. ConnectWise, ScreenConnect 23.9.8 security fix. Accessed November 2026.
8. ConnectWise, ScreenConnect 23.8 Security Fix. Accessed November 2026.
9. ConnectWise, Control Host Header Injection, Broken Access Control and Improper Authentication. Accessed November 2026.
10. ConnectWise, Trust Center Advisories. Accessed November 2026.
11. ConnectWise CVE Advisory Repository, GitHub. Accessed November 2026.
12. ConnectWise, Responding to the ScreenConnect Vulnerability. Accessed November 2026.
13. ConnectWise, ScreenConnect release notes and 2026.7 release notes. Accessed November 2026.
14. CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
15. CISA, BOD 26-04. Accessed November 2026.
16. NIST NVD API 2.0. Accessed November 2026.
17. Microsoft, Storm-1175 focuses gaze on vulnerable web-facing assets. Accessed November 2026.
18. Huntress, rogue ScreenConnect installations and SlashAndGrab explained. Accessed November 2026.