CVE-2023-47256

ConnectWise ScreenConnect (ConnectWise Control) versions through 23.8.4 are affected. Local users can connect to arbitrary relay servers due to an implicit trust of proxy settings, exposing potential bypass of proxy controls and related security boundaries. The vulnerability description is suppor...

CVE-2023-47257

CVE-2023-47257 affects ConnectWise ScreenConnect up to version 23.8.4. A remote code execution vulnerability can be leveraged by crafting messages, with a network attack vector, no privileges required, and high impact on confidentiality, integrity, and availability. Remediation is referenced in C...

CVE-2020-15838

The CVE-2020-15838 affects the ConnectWise Automate Agent Update System. Before version 2020.8, Privilege Escalation is possible due to weak permissions on the _LTUPDATE folder. The vulnerability is rooted in improper access controls, enabling an attacker with network access to escalate privilege...

CVE-2021-35066

Summary: CVE-2021-35066 is an XXE vulnerability in ConnectWise Automate prior to 2021.0.6.132. The root cause is improper handling of XML external entities in the product’s processing, allowing an attacker to potentially access sensitive data or other impact as described by CVSS, with high-severi...

CVE-2023-23126

ConnectWise Automate 2022.11 is affected by a clickjacking vulnerability where the login screen can be framed to entice users into unintended actions. The vendor claims a Content-Security-Policy header blocks this attack. Multiple sources (NVD, Red Hat, CVE listings) confirm the issue; no explici...

CVE-2023-23130

CVE-2023-23130 affects ConnectWise Automate 2022.11. The issue is cleartext authentication exposed over HTTP with SSL disabled, meaning credentials and session data could be exposed on the network. Several sources (NVD, Red Hat advisory, CVE records) describe this as an authentication flaw where ...

CVE-2020-15027

CVE-2020-15027 affects ConnectWise Automate up to 2020.x; it describes insufficient validation on certain authentication paths that can allow an authentication bypass via a series of attempts. The issue was addressed by a patch in 2020.7 and a hotfix for 2019.12. Connected documents corroborate t...

CVE-2026-9089

The CVE-2026-9089 issue affects the ConnectWise Automate Agent. According to connected sources, the agent does not fully verify the authenticity of components during plugin loading and self-update operations. The underlying impact is risk of tampered or unverified components being loaded during e...

CVE-2025-11492

CVE-2025-11492 concerns the ConnectWise Automate Agent where communications could default to HTTP instead of HTTPS, enabling a man‑in‑the‑middle attacker to intercept, modify, or replay agent–server traffic. The issue is tied to insecure transport, with mitigation in Automate 2025.9: all agent co...

CVE-2026-6066

The CVE-2026-6066 entry concerns ConnectWise Automate, specifically the Solution Center component. The vulnerability is described as client-to-server communications potentially occurring without transport-layer encryption, enabling network-based interception of Solution Center traffic in Automate...

CVE-2025-11493

The CVE-2025-11493 entry concerns the ConnectWise Automate Agent. The connected sources describe that the agent does not fully verify the authenticity of files downloaded from the server (updates, dependencies, and integrations), creating a risk of a man-in-the-middle substitution of legitimate f...