Vendor
ConnectWise
As of , 4 ConnectWise vulnerabilities are on CISA's list of exploited vulnerabilities, 2 of them used in ransomware campaigns; 2 were added in 2026. Patch first: CVE-2024-1708.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2024-1708Path Traversal | ConnectWise ScreenConnect | Patch nowRansomware use, listed within a year; Metasploit module | 0.95 | ||
| 2 | CVE-2026-84869Improper Privilege Management and Missing Authorization | ConnectWise ScreenConnect | Patch nowForensic triage required by CISA | 0.01 | ||
| 3 | CVE-2024-1709Authentication Bypass | ConnectWise ScreenConnect | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 4 | CVE-2025-3935Improper Authentication | ConnectWise ScreenConnect | Patch soon | 0.04 |
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2024 | 1 |
| 2025 | 1 |
| 2026 | 2 |