Vendor
ConnectWise
4 of 5 ConnectWise CVEs in Patchfirst (80%) are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it. of vulnerabilities exploited in the wild, 2 of them used by ransomware.
- CVEs
- 5
- In CISA KEV
- 480%
- Known ransomware use
- 2
- Median days to KEV
- 20
- from publication
- Latest KEV listing
- 11 Sep 2026
Products
In KEVOther CVEs
- ScreenConnect In KEV: 4 CVEs: 5
Top ATT&CK techniques
What attackers do with ConnectWise CVEs- T1059Command and Scripting Interpreter CVEs: 3
- T1078Valid Accounts CVEs: 2
- T1190Exploit Public-Facing Application CVEs: 1
- T1105Ingress Tool Transfer CVEs: 1
Counts are ConnectWise CVEs linked to the technique. Each link’s provenance is on the CVE page.
ConnectWise CVEs
5 CVEs, by priority- CVE-2024-1709ConnectWise ScreenConnect Authentication Bypass VulnerabilityConnectWise · ScreenConnectKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1078Valid Accounts1 report>99.9%Top 0.02%83.9priority
- CVE-2024-1708ConnectWise ScreenConnect Path Traversal VulnerabilityConnectWise · ScreenConnectKEVRansomwarePublic exploitHigh · 8.4T1059Command and Scripting Interpreter95.4%Top 0.13%78.9priority
- CVE-2026-84869ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization VulnerabilityConnectWise · ScreenConnectKEVCritical · 9.9T1078Valid AccountsT1059Command and Scripting Interpreter+1 more0.9%Top 40%67.0priority
- CVE-2025-3935ConnectWise ScreenConnect Improper Authentication Vulnerability3.6%Top 11%60.9priority
- CVE-2026-3564ScreenConnect Instance Level Cryptographic Material ExposureConnectWise · ScreenConnectCritical · 9.00.4%Top 69%55.2priority