CVE-2025-3935: ConnectWise ScreenConnect Improper Authentication Vulnerability

CVE-2025-3935 is an improper authentication vulnerability in ConnectWise ScreenConnect. According to CISA, it could allow a ViewState code injection attack that may lead to remote code execution if machine keys are compromised. ScreenConnect is widely used for remote support and access, so a successful exploit could give an attacker control over systems that administrators and help-desk staff rely on, making rapid inventory and remediation essential for IT and security teams.

Public detail is limited to the CISA description and the CWE classification; confirm exact impact, affected builds, and any additional conditions against the vendor advisory before treating any environment as safe.

How it works

The underlying weakness is CWE-287 (Improper Authentication). In this case the flaw can be abused to perform a ViewState code injection attack. ViewState is a mechanism used by certain ASP.NET applications to maintain page state; if authentication checks around it are insufficient and the machine keys that protect ViewState are known or obtainable, an attacker may be able to craft malicious ViewState data that the server deserializes and executes.

The result, when the conditions are met, can be remote code execution on the ScreenConnect host. No further exploit mechanics, payloads, or prerequisites are provided in the public summary, so treat any deeper technical claims as unconfirmed until verified against the vendor advisory.

Am I affected? How to find it in your systems

ConnectWise ScreenConnect typically runs as an on-premises server or as a cloud-hosted instance used for remote desktop, unattended access, and support sessions. It is commonly installed on Windows servers inside IT or help-desk networks and may also appear as managed cloud tenants.

• Inventory all ScreenConnect servers, appliances, and cloud instances by querying asset-management databases, scanning for the product’s default ports and service names, and reviewing software-deployment records.
• Compare installed versions and configurations against the list of fixed builds published in the vendor advisory; do not rely on version numbers that are not stated in that advisory.
• Review authentication and application logs for anomalous ViewState-related requests, unexpected authentication bypasses, or sudden process creation under the ScreenConnect service account.
• For cloud deployments, follow the applicable BOD 22-01 guidance and check tenant configuration for any exposed management interfaces.

If machine keys have ever been stored insecurely or shared across systems, treat those hosts as higher risk even if the software version appears current.

How to remediate

Apply the mitigations and updates published by ConnectWise exactly as described in the vendor advisory. CISA’s required action is to apply those mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

• Prioritize patching or configuration changes on internet-facing and high-privilege ScreenConnect instances first.
• After applying the vendor fix, rotate any machine keys that may have been exposed and restart the service to ensure the new keys are loaded.
• Verify that authentication controls around ViewState and related endpoints now enforce proper validation.
• Document the change and re-scan the environment to confirm the vulnerable configuration is no longer present.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls appropriate to this class of authentication and ViewState weaknesses.

• Place ScreenConnect hosts behind network segmentation and restrict inbound access to only trusted management networks or jump hosts.
• If a web application firewall is available, enable virtual-patching rules that inspect and block anomalous ViewState payloads or unauthenticated requests to the affected endpoints; tune rules carefully to avoid breaking legitimate support sessions.
• Disable any unnecessary remote-access or unattended features that rely on the vulnerable authentication path, if the product configuration allows it.
• Increase monitoring for authentication anomalies, unexpected ViewState traffic, and process creation under the ScreenConnect identity; alert on deviations from baseline.
• For cloud instances, tighten tenant access controls and review administrative accounts in line with BOD 22-01.

These measures lower risk but do not eliminate it; schedule the official vendor remediation as soon as possible.

If your data may have been exposed

Actively exploited authentication and remote-code-execution flaws can lead to full system compromise and subsequent data exposure. Known ransomware use of this specific CVE is not documented, yet any successful exploitation still warrants a thorough incident review. Check whether credentials or other data associated with your organization appear in known breach collections by running a free exposure scan of your email addresses; if matches are found, force password resets, revoke sessions, and investigate lateral movement from the ScreenConnect host.