CVE-2025-3935
CO
ConnectWise ScreenConnect
ConnectWise ScreenConnect Improper Authentication Vulnerability
What it is
ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
- www.connectwise.com/company/trust/security-bulletins/screenconnect-security-patch-2025.4
- nvd.nist.gov/vuln/detail/CVE-2025-3935
Description and required action as published by CISA. Full record at NVD.
Other ConnectWise entries on the list
- ScreenConnect ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization Vulnerability CVE-2026-84869 · Sep 11, 2026
- ScreenConnect ConnectWise ScreenConnect Path Traversal Vulnerability CVE-2024-1708 · Apr 28, 2026
- ScreenConnect ConnectWise ScreenConnect Authentication Bypass Vulnerability CVE-2024-1709 · Feb 22, 2024