CVE-2025-3935

ConnectWise ScreenConnect: Improper Authentication

As of , CVE-2025-3935 in ConnectWise ScreenConnect is on CISA's list of exploited vulnerabilities: CISA listed it on . Our patch-first group: Patch soon.

Exploited
Yes: CISA listed it on 2 June 2025
US federal deadline
23 June 202521 days after CISA listed it. US federal civilian agencies must fix it by then.
Used in ransomware campaigns
Not known to CISA
EPSS score
0.04Higher than 88% of the CVEs EPSS scores. EPSS estimates the chance of exploitation activity in the next 30 days.
Public exploit
None foundNeither Metasploit nor Exploit-DB lists one.
Fix
Vendor advice: www.connectwise.comLinks below, from CISA's entry.

What CISA says to do

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA's required action

What the flaw is

ConnectWise ScreenConnect contains an improper authentication vulnerability. This vulnerability could allow a ViewState code injection attack, which could allow remote code execution if machine keys are compromised.

CISA's description

ScreenConnect versions 25.2.3 and earlier versions may be susceptible to a ViewState code injection attack. ASP.NET Web Forms use ViewState to preserve page and control state, with data encoded using Base64 protected by machine keys. It is important to note that to obtain these machine keys, privileged system level access must be obtained. If these machine keys are compromised, attackers could create and send a malicious ViewState to the website, potentially leading to remote code execution on the server. The risk does not originate from a vulnerability introduced by ScreenConnect, but from platform level behavior. This had no direct impact to ScreenConnect Client. ScreenConnect 2025.4 patch disables ViewState and removes any dependency on it.

The CVE record's description, from ConnectWise

CVE published
25 April 2025
Assigned by
ConnectWise
CVSS
8.1 High (CVSS 3.1, from the CNA)
CWE-502
Deserialization of Untrusted Data
CWE-287
Improper Authentication
CISA SSVC, exploitation
active
CISA SSVC, automatable
no
CISA SSVC, technical impact
total

Timeline

  1. The CVE record was published.
  2. CISA added it to its list of exploited vulnerabilities.
  3. The US federal deadline to fix it.

ScreenConnect: other exploited entries

VulnerabilityProductOur groupListedDeadlineEPSS
CVE-2024-1708Path TraversalConnectWise ScreenConnectPatch nowRansomware use, listed within a year; Metasploit module0.95
CVE-2026-84869Improper Privilege Management and Missing AuthorizationConnectWise ScreenConnectPatch nowForensic triage required by CISA0.01
CVE-2024-1709Authentication BypassConnectWise ScreenConnectPatch this weekRansomware use; Metasploit module; EPSS 0.990.99

Read further