Latest ScreenConnect vulnerability: CVE-2026-3564 #
ConnectWise released a security bulletin for an improper verification of cryptographic signature vulnerability found in the ScreenConnect software.
The following versions are affected:
- ConnectWise ScreenConnect versions prior to 26.1
This vulnerability has been designated CVE-2026-3564 and has a CVSS score of 9 (critical).
What is ConnectWise ScreenConnect? #
ConnectWise ScreenConnect provides remote desktop access for end-users and IT professionals for support, maintenance,
or collaboration.
What is the impact? #
Successful exploitation can allow unauthorized access to ScreenConnect and unauthorized actions within the application, including privilege escalation in certain scenarios. Cloud installations are already patched.
Are updates or workarounds available? #
Users are encouraged to update to the latest version as quickly as possible (within days). The latest available release for on-premise installations is 26.1.
How do I find vulnerable ScreenConnect installations with runZero? #
From the Software Inventory, use the following query to locate potentially vulnerable ConnectWise ScreenConnect installations:
vendor:ConnectWise AND product:ScreenConnect AND (version:>0 AND version:<26.1)June 2025, ScreenConnect vulnerability (CVE-2025-3935) #
Certain versions of ConnectWise ScreenConnect may be susceptible to ViewState code injection attacks in ASP.NET Web Forms. The ViewState is used by ASP.NET to preserve page state across multiple requests. The data is encoded using Base64 and protected by cryptographic keys referred to as machine keys. It is important to note that it typically requires privileged system level access to obtain these machine keys. This issue could potentially impact any product utilizing ASP.NET framework ViewStates. There is evidence that this vulnerability is being actively exploited in the wild.
The following versions are affected:
- ConnectWise ScreenConnect versions prior to 25.2.4
This vulnerability has been designated CVE-2025-3935 and has a CVSS score of 8.1 (high).
What is the impact? #
If machine keys are compromised, successful exploitation of the vulnerability could allow attackers to create and send a malicious ViewState to the website, potentially leading to remote code execution on the server.
Are updates or workarounds available? #
ConnectWise has released an update, 25.2.4, that fixes these issues by disabling the ViewState and removing any dependency on it. ConnectWise recommends that all users upgrade to this version immediately.
How do I find vulnerable ScreenConnect installations with runZero? #
From the Software Inventory, use the following query to locate potentially vulnerable ConnectWise ScreenConnect installations:
vendor:ConnectWise AND product:ScreenConnect AND (version:>0 AND version:<25.2.4)
Previous ScreenConnect vulnerabilities (CVE-2024-1708, CVE-2024-1709) #
On February 19, 2024, ConnectWise disclosed two serious vulnerabilities in their ScreenConnect (formerly Control) remote-access product.
The first vulnerability is an authentication bypass vulnerability. Successful exploitation of this vulnerability would allow attackers to execute arbitrary commands with full privileges on the target system. This vulnerability has been assigned a CVSS score of 10, indicating a highly critical vulnerability.
The second issue is a path-traversal vulnerability. Successful exploitation of this vulnerability would allow attackers to access restricted resources on vulnerable systems. The vendor has not disclosed what resources may be accessed when exploiting this vulnerability. This vulnerability has been assigned a CVSS score of 8.4, indicating a high severity.
Note that CVEs are not yet assigned for these vulnerabilities.
Note that there is evidence that these vulnerabilities are being actively exploited in the wild.
What is the impact? #
Successful exploitation of these vulnerabilities would allow attackers to execute arbitrary commands with full privileges on the target system, potentially leading to complete system compromise.
Are updates or workarounds available? #
ConnectWise has released an update, version 23.9.8, that fixes these issues. ConnectWise recommends that all users upgrade to this version immediately.
How do I find ScreenConnect installations with runZero? #
From the Services Inventory, use the following query to locate potentially vulnerable ConnectWise ScreenConnect systems:
vendor:ConnectWise AND (product:Control OR product:ScreenConnect)
Note the check for the former product name (“Control”).
Additional fingerprinting research is ongoing, and additional queries will be published as soon as possible.
