VendorsIT management

ConnectWise

ConnectWise makes software for managed service providers, including ScreenConnect remote access, Automate remote monitoring and management, and the PSA business platform.

Response trend, 6 months: Not enough history
Open now: None
Latest incident: 3 Sep 2026
Incidents on record: 2

Response to exploited bugs

Not rated. 2 reviewed zero-days on record. A grade needs at least 3.

Fixing privately reported bugs

Not rated. No private reports in the grading window.

What a grade means. B means the vendor met the public norm, such as a first fix within 7 days of the first public report or a private fix within 120 days. Taking half the norm time scores 92, an A. Taking twice the norm time scores 43, a D−. How grades work

Embed this report card

Why these grades

Response to exploited bugs: not rated. 2 reviewed zero-days in the last 36 months. A grade needs at least 3.
First fix within a day for 1 of 2 zero-days. The other one took 5 days.
Every supported version fixed within a day for 1 of 2 zero-days. The other one took 5 days.
First advisory within a day for all 2 zero-days.
Fixing privately reported bugs: not rated. No private reports in the last 36 months.
1 of 3 reviewed exploited bugs had a public fix before exploitation was reported. It does not count toward the response grade. For one of them, fixes for every version came later, up to 4 days.
NR (not rated) means a subject has fewer than 3 data points from the last 36 months, or their recency weights add up to less than one current data point. For response, a data point is a reviewed exploited zero-day. For private fixes, it is a private report (one vendor, one report date). KEV listings alone never rate a vendor. A grade is provisional when the vendor's own evidence does not yet outweigh the starting value, or confidence is below medium.

Response to exploited bugs: sub-scores

Time to first advisory2 of 2 zero-days within a day
81
2 cases, low confidence, not used for this vendor
Time to first fix1 of 2 zero-days within a day, longest 5 days
78
2 cases, low confidence, not used for this vendor
Time to fix all versions1 of 2 zero-days within a day, longest 5 days
81
2 cases, low confidence, not used for this vendor
OpennessAdvisories available by RSS. 1 of 1 zero-day with a dated revision history. 2 of 2 fixed zero-days with a public fix date for every version. 1 of 1 zero-day not fixed within a day had an advisory or mitigation within 72 hours.
67
4 cases, low confidence, not used for this vendor

Fixing privately reported bugs: sub-score

Private fix speedNo private reports in the last 36 months
NR
0 cases, not used

Response fingerprint

Compressed time scale

Counts toward the response grade 2

Not graded 1: n-days, unreviewed timelines and end-of-life products

19 Feb 2024
ConnectWise ScreenConnect authentication bypass and path traversal (ScreenConnect 23.9.8 security fix)Not graded: n-day

Vendor silent
Vendor statement, no fix
Fixed for some versions
Open, no fix
Open, partly fixed
Fixed when disclosed
Date only, no time of day

One row per exploited incident, newest first. A tick at the start means a fix existed when the bug went public.

Exploited incidents

First report	Incident	CVSS	Silence	First fix	All fixed	Status	Grade
3 Sep 2026	ConnectWise ScreenConnect client file transfer and execution without authorization (26.6.5 bulletin)CVE-2026-84869	9.9	same day	5d	5d	Fixed	Counts toward grade
24 Apr 2025	ConnectWise ScreenConnect ViewState code injection (ScreenConnect 25.2.4 security patch)CVE-2025-3935	8.1	same day	same day	same day	Fixed	Counts toward grade
19 Feb 2024	ConnectWise ScreenConnect authentication bypass and path traversal (ScreenConnect 23.9.8 security fix)CVE-2024-1709, CVE-2024-1708	10.0	same day	same day	4d	Fixed	Not graded: n-day

Private reports

Bugs reported privately to ConnectWise by ZDI or Project Zero.

No privately reported cases from ZDI or Project Zero in the window.

Advisories changed after publication

26 Apr 2025screenconnect-security-patch-2025.4
Changed without a revision note
ScreenConnect 25.2.4 Security Patch
CVSS base vector changed from AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H to AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
- Severity
CVSS vector
BeforeAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AfterAV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Verbatim wording. Removed text is struck through. Added text is bold.
Before
tes, and ScreenConnect is not an outlier. Vulnerability CWE ID | Description | Base Score | Vector CWE-287 | Improper Authentication | ~~8.8~~ | ~~CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H~~ Severity ~~High—Vulnerabilities~~ that could compromise confidential data or other processing resources but require additional access / privilege to do so. Priority 1 High—Vulnerabilities that are either being ~~targeted~~
After
tes, and ScreenConnect is not an outlier. Vulnerability CWE ID | Description | Base Score | Vector CWE-287 | Improper Authentication | 8.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H Severity Important—Vulnerabilities that could compromise confidential data or other processing resources but require additional access / privilege to do so. Priority 1 High—Vulnerabilities that are either being tar
Earlier version captured 25 Apr 2025, 11:15 UTC: archived copyLater version captured 26 Apr 2025, 02:44 UTC: archived copyRecovered from archived copiesSnapshots 710f44f14a… and 9247f826e9…Incident page

Grade history

Response to exploited bugs: score at the end of each month.

Not rated at any point in this period.

Channels

Get ConnectWise's own alerts

RSSConnectWise Trust Center security bulletins RSSAdd the advisory feed to a feed reader or chat integration.
Advisory pageConnectWise Trust Center security bulletinsCheck the advisory page. It has no push channel.

What we watch

RSSConnectWise Trust Center security bulletins RSS

See sources and health for when each was last read.