ConnectWise vulnerabilities & exploitation

Exploitation timeline

Threadlinqs has recorded 6 ConnectWise CVEs published between 2024-02-15 and 2026-09-15. The busiest month was 2024-02 (2 new CVEs). 4 of them (67%) are listed in CISA KEV, which means exploitation in the wild has been confirmed.

Most exploited vulnerabilities

Ranked with CISA KEV listings first, then EPSS exploit probability, then CVSS score. Showing 6 of 6 tracked ConnectWise CVEs.

• CVE-2024-1709critical 10KEVRansomwareEPSS 100%2024-02-21
• CVE-2024-1708high 8.4KEVRansomwareEPSS 95.4%2024-02-21
• CVE-2025-3935high 8.1KEVEPSS 3.5%2025-04-25
• CVE-2026-84869critical 9.9KEVEPSS 0.7%2026-09-08
• CVE-2025-14265critical 9.1EPSS 0.4%2025-12-11
• CVE-2026-9089high 8.8EPSS 0.2%2026-05-21

Products affected

Threadlinqs normalises CPE and CNA product records across all 6 CVEs; 2 distinct ConnectWise products are affected. The most frequently affected:

• ScreenConnect 5 CVEs
• Automate 1 CVE

Threat activity

39 tracked threat campaigns reference ConnectWise products or exploit ConnectWise CVEs; the 25 most recent are listed.

• Healthcare Sector Ransomware Targeting and Expanding Attack Surface (Qilin, Akira, DragonForce, LockBit, The Gentlemen)HIGH2026-10-09
• Q3 2026 Record Ransomware Surge: 2,627 Claimed Attacks, Qilin and The Gentlemen Lead, Clop Resurgence via PTC Windchill CVE-2026-12569HIGH2026-10-09
• Phishing Campaign Abuses Microsoft Power BI to Deploy Rogue ScreenConnect RMMsHIGH2026-10-07
• Phishing Campaign Abuses Legitimate ScreenConnect Client for Remote Access via Fake Payment NotificationMEDIUM2026-10-05
• ScreenConnect Client Abused by Attackers via Mejuri-Themed Payment Receipt PhishingMEDIUM2026-10-01
• RMM tools distributed via phishing: ScreenConnect, FleetDeck, Datto, SimpleHelp, JumpCloud and N-able abused for remote accessHIGH2026-10-01
• CSuite Phishing Operation Steals Microsoft 365 Sessions via Device-Code Phishing and Deploys ScreenConnect/Action1 RMM Tools Against US and EU OrganizationsHIGH2026-09-30
• Phishing Campaigns Abuse RMM Tools (MSP360, ScreenConnect) for Persistent AccessHIGH2026-09-29
• OS-Aware Phishing Kit Fans Fake iCloud Alert into ScreenConnect RMM, Apple ID, and M365 AiTM HarvestersHIGH2026-09-27
• Multi-Stage Abuse of Legitimate Remote Access Tools (ConnectWise, N-Able, SimpleHelp, Datto RMM, GoTo) by Initial Access BrokersHIGH2026-09-25
• CISA Warns of Active Exploitation of Critical ConnectWise ScreenConnect Flaw (CVE-2026-84869, CVSS 9.9)CRITICAL2026-09-16
• ScreenConnect Backdoor Delivered via SSA-Impersonation Phishing LureMEDIUM2026-09-14
• Browser-in-the-Browser Phishing Campaign Abuses ScreenConnect RMM to Gain Remote AccessHIGH2026-09-09
• Global Credential-Stealing Phishing Campaign Abusing Trusted Google Services as Redirect InfrastructureHIGH2026-09-07
• US-First RMM Phishing Campaign Spans 46 Countries via Disposable Vercel/Netlify Infrastructure and Password-Protected VBS-to-PowerShell DeliveryHIGH2026-09-03
• BlueKit Phishing-as-a-Service Adds ZeroBot Bot-Screening and ScreenConnect Delivery to Target Financial-Sector CEOs via Browser-in-the-MiddleHIGH2026-09-03
• SMOKE#SCREEN — Multi-Wave Phishing Campaign Abusing ConnectWise ScreenConnect RMM for Persistent Remote AccessHIGH2026-08-04
• Evolution of Remote Access Tool (RAT/RMM) Abuse: Multi-Stage Chaining of ConnectWise, GoTo, Datto, SimpleHelp, N-able, and Heartbeat RMMEDIUM2026-08-02
• Operation BlueDash: Fake Microsoft Teams Update Deploys Dual RMM Backdoors (Level RMM + ScreenConnect)HIGH2026-07-27
• MuddyWater APT (Iran MOIS-linked, G0069) abuses legitimate RMM tools, VBA macro loaders, and Rust-compiled payloads in ongoing global espionage campaignHIGH2026-07-19
• AsyncRAT Campaign Uses DLL Sideloading and ScreenConnect for Stealthy Remote Access (SEO-Poisoned Fake Installer Sites)HIGH2026-07-02
• ScreenConnect Masked as Freeware: Large-Scale AsyncRAT Distribution Campaign via SEO-Poisoned Fake Software SitesHIGH2026-07-01
• Cross-Platform Phishing Campaigns Auto-Adapt Payloads to Victim Device/OS via FingerprintingHIGH2026-07-01
• The Quarry PhaaS/MaaS Operation Impersonating IRS and SSA to Deliver ConnectWise ScreenConnect RMM AccessHIGH2026-06-15
• RatPressto Phishing Kit — Fake Adobe Document Cloud Pages Deliver ConnectWise ScreenConnect RATMEDIUM2026-05-29

Threat actors targeting ConnectWise

Named threat actors attributed to campaigns that involve ConnectWise products or CVEs, with the number of linked campaigns:

• Qilin 2
• Storm-1175 2
• The Gentlemen 2
• Akira 1
• Andariel 1
• APT35 1
• APT38 1
• APT42 1
• Black Basta 1
• Clop 1
• DragonForce 1
• Lazarus Group 1

How to prioritise ConnectWise patching

This order follows the data Threadlinqs holds for ConnectWise, not a generic severity checklist:

• 4 of 6 ConnectWise CVEs (67%) are in CISA KEV: treat them as actively exploited and remediate them first, starting with CVE-2024-1709, CVE-2024-1708, CVE-2025-3935.
• 2 CVEs are known to be used in ransomware campaigns; patch these ahead of other KEV entries on internet-facing systems.
• Outside KEV, the highest EPSS scores are CVE-2025-14265 (0.4%), CVE-2026-9089 (0.2%).
• 3 CVEs score Critical and 3 High on CVSS v3 (maximum 10, average 9.1); sequence these after KEV and high-EPSS items.
• 3 CVEs have a public exploit or proof of concept recorded, which shortens the time from disclosure to attack.

About this data

Vendor attribution comes from the CNA and CPE product records of each CVE, folded to one vendor name; CVSS, EPSS and KEV status are read from the Threadlinqs CVE catalog; campaign and actor links come from tracked threat records. Counts reflect the data as of 2026-10-10 and refresh daily.